Detection rules › Sigma

Remote Access Tool - Renamed MeshAgent Execution - Windows

Severity
high
Author
Norbert Jaśniewicz (AlphaSOC)
Source
upstream

Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management. However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1036.003 Masquerading: Rename Legitimate Utilities
Command & ControlT1219.002 Remote Access Tools: Remote Desktop Software

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: selection_meshagent

or:
CommandLine|contains: --meshServiceName
OriginalFileName|contains: meshagent

Stage 2: not 1 of filter_main_legitimate

Image|endswith: '\meshagent.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • --meshServiceName corpus 2 (sigma 2)
Imageends_with
  • \meshagent.exe
OriginalFileNamematch
  • meshagent