Remote Access Tool - MeshAgent Command Execution via MeshCentral
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects the use of MeshAgent to execute commands on the target host, particularly when threat actors might abuse it to execute commands directly. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Process started" AND PARENTPROCESSNAME endswith "\meshagent.exe" AND PROCESSNAME endswith "\cmd.exe,\powershell.exe,\pwsh.exe" select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
@Kostastsale
