3BB: Unauthorized MeshCentral Agent Deployment via TH-3BB Meshagent Path
Detects the execution of MeshCentral remote management agent (meshagent.exe) or activity associated with its default installation paths and markers. MeshCentral is legitimate remote access software that can be abused by adversaries for persistence and command-and-control access.
Microsoft Sentinel (KQL)
