MeshCentral Agent Command Execution

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•2

This rule identifies the execution of MeshCentral for remote command execution, specifically looking for command-line arguments containing 'meshctrl.js' and 'RunCommand'. This activity has been observed in attacks such as those by ShinyHunters to stage payloads on compromised Oracle PeopleSoft servers.