Mesh Agent remote monitoring tool deployment via known hash
This rule monitors for the execution of a process with a specific SHA1/MD5 file hash known to be malicious. This is a high-fidelity detection strategy for blocking or alerting on specific threats already identified as malicious in threat intelligence.
Microsoft Sentinel (KQL)
