Settra MeshAgent RMM Deployment and C2 Connection
Detects the execution or deployment of MeshAgent, a legitimate Remote Monitoring and Management (RMM) tool, which is often abused by adversaries to maintain persistence and command-and-control access. The rule monitors for common process names such as meshagent.exe and mvtcs.exe, as well as command-line arguments containing 'meshagent'.
YARA-L
