{"id":"b471f462-eb0d-4832-be35-28d94bdb4780","title":"Remote Access Tool - Renamed MeshAgent Execution - Windows","description":"Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent.\nRMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management.\nHowever, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.\n","author":"Norbert Jaśniewicz (AlphaSOC)","status":"experimental","level":"high","date":"2025-05-19","modified":"","tags":["attack.command-and-control","attack.stealth","attack.t1219.002","attack.t1036.003"],"technique_ids":["T1036.003","T1219.002"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access","https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/","https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/","https://www.security.com/threat-intelligence/medusa-ransomware-attacks"],"source_path":"rules/windows/process_creation/proc_creation_win_remote_access_tools_renamed_meshagent_execution.yml","source_sha256":"9719606e6a1e35ac8504a9ecd25d5eac6e9d0b8e1b846f5164bf926feb6ca808","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_remote_access_tools_renamed_meshagent_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Remote Access Tool - Renamed MeshAgent Execution - Windows\nid: b471f462-eb0d-4832-be35-28d94bdb4780\nrelated:\n    - id: bd3b5eaa-439d-4a42-8f35-a49f5c8a2582\n      type: similar\n    - id: 2fbbe9ff-0afc-470b-bdc0-592198339968\n      type: derived\nstatus: experimental\ndescription: |\n    Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent.\n    RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management.\n    However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.\nreferences:\n    - https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access\n    - https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/\n    - https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/\n    - https://www.security.com/threat-intelligence/medusa-ransomware-attacks\nauthor: Norbert Jaśniewicz (AlphaSOC)\ndate: 2025-05-19\ntags:\n    - attack.command-and-control\n    - attack.stealth\n    - attack.t1219.002\n    - attack.t1036.003\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_meshagent:\n        - CommandLine|contains: '--meshServiceName'\n        - OriginalFileName|contains: 'meshagent'\n    filter_main_legitimate:\n        Image|endswith: '\\meshagent.exe'\n    condition: selection_meshagent and not 1 of filter_main_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1036.003","id":"T1036.003","name":"Rename Legitimate Utilities","page":"techniques/enterprise/T1036.003/"},{"key":"enterprise/T1219.002","id":"T1219.002","name":"Remote Desktop Software","page":"techniques/enterprise/T1219.002/"}],"data_path":"data/detection-rules/b471f462-eb0d-4832-be35-28d94bdb4780.json","kind":"sigma"}