Settra Actors Deploying MeshAgent RMM (mvtcs.exe rename)
Detects the execution of MeshAgent, a remote monitoring and management (RMM) tool, by monitoring for its associated process names (meshagent.exe, mvtcs.exe) or command lines containing the string 'MeshAgent'. Adversaries often abuse such legitimate remote access tools to establish persistent command and control channels or to perform unauthorized administrative activities.
SentinelOne
