Brass magnifying glass over glowing footprints on a punch-card floor under a red lamp, tracing BeyondTrust appliance post-exploitation paths, navy red and chrome on aged paper, no text

Hunt: BeyondTrust ARMORY CASTLE SAWFLY / BARECLAW

Home » Hunt Lab » Hunt: BeyondTrust ARMORY CASTLE SAWFLY / BARECLAW

Companion hunt to the BeyondTrust Remote Support CVE-2026-102764 Alert. Mandiant attributes zero-day abuse to ARMORY CASTLE and published SAWFLY / BARECLAW YARA — use those for content matching, and the Sigma/KQL below for path and process behaviour.

Hypothesis

If an internet-facing BeyondTrust Remote Support appliance (≤26.2.3, unpatched BT26-05-RS) was exploited, expect unauthenticated file writes into the site web root, a PHP webshell (SAWFLY / mangoapi.php), vault dumping via bt-secrets, SUID helpers, post_boot.d persistence, and a SOCKS/WebSocket tunneler (BARECLAW / ingredi_ws). Appliance-local logs are unreliable: Mandiant saw active deletion.

Data sources

  • Reverse proxy / WAF in front of the appliance (full URI, WebSocket upgrades)
  • Forwarded syslog from the appliance (user_changed, /login success)
  • File-create and process telemetry on rebuilt or forensic images (customers cannot usually instrument the live appliance host)
  • Mandiant YARA G_Hunting_Webshell_SAWFLY_1 and G_Hunting_Backdoor_BARECLAW_1 from the GTIG post

ATT&CK

  • T1190 Exploit Public-Facing Application
  • T1505.003 Server Software Component: Web Shell
  • T1003 OS Credential Dumping
  • T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid
  • T1090 Proxy
  • T1070.004 Indicator Removal: File Deletion

Queries

Sigma rules in the Hunt Lab pack cover (1) unexpected .php under ingredi/app/laravel/public/ or bomgar/htdocs/, (2) bt-secrets / SUID / post_boot.d / BARECLAW-like CLI, and (3) proxy hits on staging PHP or /uidchanarge. Hand KQL for Microsoft Defender for Endpoint sits beside the rules. Do not copy Mandiant YARA into your repo without checking licence — pull rule bodies from the primary GTIG URL named in sources.

DeviceFileEvents
| where Timestamp > ago(14d)
| where ActionType in ("FileCreated", "FileRenamed")
| where FileName endswith ".php"
    and (FolderPath has @"ingredi/app/laravel/public"
        or FolderPath has @"bomgar/htdocs"
        or FileName has "mangoapi"
        or FileName has "app_84304470")
| project Timestamp, DeviceName, FolderPath, FileName, InitiatingProcessFileName, SHA256

Triage

  1. Confirm BT26-05-RS (or SaaS auto-patch) before rotating anything the appliance still holds.
  2. Preserve disk + memory first; rebuild rather than clean if compromise is plausible.
  3. Review user_changed Jump Item / Teams roles raised to Administrator; /login from residential or VPN ranges; file-transfer sessions in the exposure window.
  4. Scan recovered web roots with Mandiant SAWFLY / BARECLAW YARA; defang any hashes you publish.

False positives

Vendor patch drops, authorised Support sessions, and scanners replaying Mandiant path strings after disclosure. Tune path seeds; they will go stale.

Sources

Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)