MeshCentral Agent Command Execution
This rule identifies the execution of MeshCentral for remote command execution by looking for specific command-line arguments. It specifically targets instances where 'meshctrl.js' and 'RunCommand' are present in process command lines or syslog messages. This activity has been associated with threat actors like ShinyHunters.
Splunk (SPL)
