Remote Access Tool - Potential MeshAgent Execution - MacOS

SigmaHQ Detections@sigmaHQ

•updated Jun 24, 2025•0•0•3

Detects potential execution of MeshAgent which is a tool used for remote access. Historical data shows that threat actors rename MeshAgent binary to evade detection. Matching command lines with the '--meshServiceName' argument can indicate that the MeshAgent is being used for remote access.