MeshAgent RMM Deployment (Renamed Binary mvtcs.exe / C2 45.13.122.7)

Ibrahim Saud@tektrix

•updated Sep 18, 2026•0•0•3

Detects the execution of the MeshCentral remote management agent (meshagent.exe) or processes masquerading as the agent using the known alias 'mvtcs.exe'. This rule identifies the start of these processes to detect unauthorized or potentially malicious remote management activity.