Remote Access Tool - Renamed MeshAgent Execution - MacOS
Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. This rule specifically looks for process creation events on macOS where the command line contains '--meshServiceName' or the original filename contains 'meshagent', but the image path does not end with the legitimate '/meshagent' or '/meshagent_osx64' paths. This behavior is indicative of an adversary attempting to bypass detection by masquerading the RMM tool.
Sigma
