Mesh Agent Service Installation

SigmaHQ Detections@sigmaHQ

•updated Jun 13, 2025•0•24

Detects the installation of the Mesh Agent service, which is commonly used for remote computer management. This rule specifically looks for Windows Event ID 7045 from the Service Control Manager, indicating a service installation, and then checks if the service's image path contains 'MeshAgent.exe' or if the service name contains 'Mesh Agent'.