All Detections

MeshCentral CLI Execution (ShinyHunters TTP)

avatar
Ethan Andrews@eandrews
updated Jun 10, 202611019

Detects the execution of MeshCentral's command-line utility via Node.js, a technique observed in ShinyHunters attacks against Oracle PeopleSoft servers.

Microsoft Sentinel (KQL)