BeyondTrust Appliance - Local Administrator Account Created

Georg Lauenstein@gsec

•updated 5 days ago•0•0•1

Detects creation of a new local administrative account on or through a BeyondTrust Remote Support / Privileged Remote Access appliance. Post-exploitation of the pre-auth vulnerability, attackers create local admin accounts (T1136.001) to maintain persistent access to the appliance and connected managed endpoints. Follows CISA's urgent patch advisory for BeyondTrust appliances.