ShinyHunters MeshCentral Agent Deployment on PeopleSoft Servers

Ibrahim Saud@tektrix

•updated Jun 24, 2026•2•0•4

Detects the deployment and execution of the MeshCentral remote management agent on PeopleSoft servers, which is indicative of unauthorized access by the ShinyHunters threat group. The rule triggers on the execution of the meshctrl.js script using the RunCommand function with suspicious loopback WebSocket connections, or the direct execution of the meshagent binary from within the /opt/meshcentral/ directory.