BeyondTrust Secrets Utility Vault Credential Access via CommandLine

Rule Info

Name
BeyondTrust Secrets Utility Vault Credential Access via CommandLine
Author
AzizFarghly (Nextron Systems)
Description
Detects execution of bt-secrets, a BeyondTrust (formerly Bomgar) proprietary CLI utility used to query the appliance credential vault. Adversaries could abuse this tool to harvest stored credentials during post-exploitation, as observed in exploitation of CVE-2026-102764 (ARMORY CASTLE).
Reference
https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust
Date
2026-10-23 00:00:00
Modified
None
Id
0a82f393-ac8e-41bd-a93d-3e53f7cc39fe
Tags
attack.credential-access attack.t1552.001 cve.2026-102764
Type
Nextron Sigma feed only (private)

Rule History

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022