Renamed MeshAgent Execution - Windows

SigmaHQ Detections@sigmaHQ

•updated Jun 24, 2025•1•0•19

Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. Malicious actors often rename legitimate tools like MeshAgent to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.