MeshCentral Agent Command Execution
Identifies the execution of MeshCentral for remote command execution, specifically looking for 'meshctrl.js RunCommand' in process command lines or syslog messages. This activity has been associated with threat actors like ShinyHunters for staging payloads.
Microsoft Sentinel (KQL)
