MeshAgent RMM renamed to mvtcs.exe with Settra C2 beaconing
Detects the presence of MeshAgent remote monitoring and management (RMM) software, often used for persistence or unauthorized remote access. The rule correlates process execution indicators (including potential renaming of mvtcs.exe) with network communication to known malicious infrastructure associated with Settra ransomware.
Splunk (SPL)
