Remote Access Tool - Renamed MeshAgent Execution - MacOS — Sigma Rule

Rule metadata and linked tags

Author: Norbert Jaśniewicz (AlphaSOC). Source status: experimental; severity: high. Source dates: 2025-05-19 / not supplied.

{
  "category": "process_creation",
  "product": "macos"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 98ff8e2f3668f1f918d46a63b97750165f72cdb47e0300ec3a58e2321a376fa7

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Remote Access Tool - Renamed MeshAgent Execution - MacOS
id: bd3b5eaa-439d-4a42-8f35-a49f5c8a2582
related:
    - id: b471f462-eb0d-4832-be35-28d94bdb4780
      type: similar
    - id: 22c45af6-f590-4d44-bab3-b5b2d2a2b6d9
      type: derived
status: experimental
description: |
    Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent.
    RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management.
    However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.
references:
    - https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access
    - https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/
    - https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/
    - https://www.security.com/threat-intelligence/medusa-ransomware-attacks
author: Norbert Jaśniewicz (AlphaSOC)
date: 2025-05-19
tags:
    - attack.command-and-control
    - attack.stealth
    - attack.t1219.002
    - attack.t1036.003
logsource:
    category: process_creation
    product: macos
detection:
    selection_meshagent:
        - CommandLine|contains: '--meshServiceName'
        - OriginalFileName|contains: 'meshagent'
    filter_main_legitimate:
        Image|endswith:
            - '/meshagent'
            - '/meshagent_osx64'
    condition: selection_meshagent and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

Original YAML and metadata in JSON

False positives

• Unknown

Source references

• https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access
• https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/
• https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/
• https://www.security.com/threat-intelligence/medusa-ransomware-attacks