Query: detection rule: Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. RMM tools suc
Matching passage: Sigma rule: Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. RMM tools suc. Logsource: windows / process_creation. Rule: title: Remote Access Tool - Renamed MeshAgent Execution - Windows id: b471f462-eb0d-4832-be35-28d94bdb4780 related: - id: bd3b5eaa-439d-4a42-8f35-a49f5c8a2582 type: similar - id: 2fbbe9ff-0afc-470b-bdc0-592198339968 type: derived status: experimental description: 'Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management. However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems. ' references: - https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access - https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/ - https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/ - https://www.security.com/threat-intelligence/medusa-ransomware-attacks author: Norbert Jaśniewicz (AlphaSOC) date: 2025-05-19 tags: - attack.command-and-control - attack.stealth - attack.t1219.002 - attack.t1036.003 logsource: category: process_creation product: windows detection: selection_meshagent: - CommandLine|contains: --meshServiceName - OriginalFileName|contains: meshagent filter_main_legitimate: Image|endswith: \meshagent.exe condition: selection_meshagent and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects an appx package deployment that was blocked by the local computer policy. The following events indicate that an. Logsource: windows / appxdeployment-server. Rule: title: Deployment Of The AppX Package Was Blocked By The Policy id: e021bbb5-407f-41f5-9dc9-1864c45a7a51 status: test description: 'Detects an appx package deployment that was blocked by the local computer policy. The following events indicate that an AppX package deployment was blocked by a policy: - Event ID 441: The package deployment operation is blocked by the "Allow deployment operations in special profiles" policy - Event ID 442: Deployments to non-system volumes are blocked by the "Disable deployment of Windows Store apps to non-system volumes" policy." - Event ID 453: Package blocked by a platform policy. - Event ID 454: Package blocked by a platform policy. ' references: - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting - https://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWEventsList/CSV/Windows11/22H2/W11_22H2_Pro_20220920_22621.382/Providers/Microsoft-Windows-AppXDeployment-Server.csv author: frack113 date: 2023-01-11 tags: - attack.defense-impairment logsource: product: windows service: appxdeployment-server detection: selection: EventID: - 441 - 442 - 453 - 454 condition: selection falsepositives: - Unlikely, since this event notifies about blocked application deployment. Tune your applocker rules to avoid blocking legitimate applications. level: medium