Mesh Agent Service Installation
Detects a Mesh Agent service installation. Mesh Agent is used to remotely manage computers
Sigma rule (View on GitHub)
1title: Mesh Agent Service Installation
2id: e0d1ad53-c7eb-48ec-a87a-72393cc6cedc
3status: test
4description: Detects a Mesh Agent service installation. Mesh Agent is used to remotely manage computers
5references:
6 - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
7author: Nasreddine Bencherchali (Nextron Systems)
8date: 2022-11-28
9tags:
10 - attack.command-and-control
11 - attack.t1219
12logsource:
13 product: windows
14 service: system
15detection:
16 selection_root:
17 Provider_Name: 'Service Control Manager'
18 EventID: 7045
19 selection_service:
20 - ImagePath|contains: 'MeshAgent.exe'
21 - ServiceName|contains: 'Mesh Agent'
22 condition: all of selection_*
23falsepositives:
24 - Legitimate use of the tool
25level: medium
References
Related rules
- Antivirus Exploitation Framework Detection
- Anydesk Temporary Artefact
- DNS Query To AzureWebsites.NET By Non-Browser Process
- GoToAssist Temporary Installation Artefact
- HackTool - Inveigh Execution Artefacts