Remote Access Tool - Potential MeshAgent Execution - Windows
Detects potential execution of MeshAgent, a remote access tool, by looking for the '--meshServiceName' argument in the command line. Threat actors often rename the MeshAgent binary to evade detection, making this command-line argument a more reliable indicator of its use for remote access.
Sigma
