Execution of Remote Access Utility - Possible MeshAgent - Windows (via process_creation)

title: Execution of Remote Access Utility - Possible MeshAgent - Windows (via process_creation)
id: 49e8e48e-ccf1-56dc-9318-aff33ee23c2e
status: stable
description: This rule detects potential execution of MeshAgent which is a tool used for remote access. Historical data shows that threat actors rename MeshAgent binary to evade detection. Matching command lines with the '--meshServiceName' argument can indicate that the MeshAgent is being used for remote access.
references:
    - https://attack.mitre.org/techniques/T1219/002/
    - https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access
    - https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/
    - https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/
    - https://www.security.com/threat-intelligence/medusa-ransomware-attacks
author: Huntrule Team
date: 2026-04-04
tags:
    - attack.command-and-control
    - attack.t1219.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: '--meshServiceName'
    condition: selection
falsepositives:
    - Unknown
level: medium