Bomgar Exploit - Data Exfiltration via Archive Creation

Ibrahim Saud@tektrix

•updated Jun 22, 2026•2•0•6

Correlates the exploited Bomgar service gathering and compressing large amounts of internal data into an archive file prior to egress. This rule specifically looks for Bomgar processes initiating archive creation using common archiving utilities like tar, zip, or 7z, with the command line indicating the creation of a .zip or .tar.gz file.