MeshAgent RMM Deployment (incl. renamed mvtcs.exe) for C2 Access
Detects the execution, network connections, and service installation of MeshAgent or associated binaries (e.g., mvtcs.exe). The rule identifies potential unauthorized or malicious use of this remote management software by looking for process activity, specific network connections to known infrastructure, and service persistence mechanisms.
Microsoft Sentinel (KQL)
