MeshAgent Command Execution via Command Interpreters

SigmaHQ Detections@sigmaHQ

•updated Aug 14, 2025•1•0•16

Detects the use of MeshAgent to execute commands on the target host, specifically when it spawns command-line interpreters like cmd.exe, powershell.exe, or pwsh.exe. This behavior can be abused by threat actors to execute arbitrary commands directly on a compromised system, potentially leveraging MeshAgent's capabilities to obscure activities.