MeshCentral Agent Remote Command Execution

nomit vyas@xoxo

•updated Jun 25, 2026•0•0•11

Detects the execution of MeshCentral agent commands, specifically the 'RunCommand' feature, which is often used by adversaries for post-compromise remote command execution and payload staging. This rule monitors both endpoint process activity and system logs for command-line arguments involving meshctrl.js and RunCommand.