Remote Access Tool - Potential MeshAgent Execution - MacOS

SigmaHQ Detections@sigmaHQ

•updated Jun 24, 2025•1•0•38

Detects potential execution of MeshAgent, a remote access tool, on macOS systems. The rule specifically looks for the '--meshServiceName' argument in the command line, which is indicative of MeshAgent usage. Threat actors often rename the MeshAgent binary to evade detection, making command-line arguments a more reliable indicator.