ShinyHunters - MeshCentral Agent Masquerade (UNC6240)
Detects file creation or process launch of a MeshCentral remote-management agent that has been renamed to impersonate an Azure service, or whose hash matches a known sample, as used by the ShinyHunters threat actor for persistent remote access during the Oracle PeopleSoft exploitation campaign reported by Mandiant in June 2026.
YARA-L
