macOS Process Creation: MeshAgent Remote Access via --meshServiceName
Alerts on macOS process executions containing --meshServiceName, indicating potential MeshAgent remote access usage.
- Product
- macos
- Category
- process_creation
- Author
- Norbert Jaśniewicz (AlphaSOC) (SigmaHQ), DRL 1.1
- Published
- 2025-05-19
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags macOS process creations whose command line contains the "--meshServiceName" argument, indicating potential MeshAgent remote access usage. Remote access tooling is commonly abused by attackers for persistence and command-and-control, and attackers may rename MeshAgent binaries to reduce detection. The detection relies on macOS process creation telemetry and the presence of the specific command-line argument.
Reporting behind it
- huntress.comhttps://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access
- thecyberexpress.comhttps://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/
- wazuh.comhttps://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/
- security.comhttps://www.security.com/threat-intelligence/medusa-ransomware-attacks
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_remote_access_tools_meshagent_arguments.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "macOS Process Creation: MeshAgent Remote Access via --meshServiceName"
id: 45bfc75f-3745-4baa-a2d6-be8e90186fd0
related:
- id: 2fbbe9ff-0afc-470b-bdc0-592198339968
type: similar
- id: 22c45af6-f590-4d44-bab3-b5b2d2a2b6d9
type: derived
status: experimental
description: This rule flags macOS process creations whose command line contains the "--meshServiceName" argument, indicating potential MeshAgent remote access usage. Remote access tooling is commonly abused by attackers for persistence and command-and-control, and attackers may rename MeshAgent binaries to reduce detection. The detection relies on macOS process creation telemetry and the presence of the specific command-line argument.
references:
- https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access
- https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/
- https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/
- https://www.security.com/threat-intelligence/medusa-ransomware-attacks
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_remote_access_tools_meshagent_arguments.yml
author: Norbert Jaśniewicz (AlphaSOC), Huntrule Team
date: 2025-05-19
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
category: process_creation
product: macos
detection:
selection:
CommandLine|contains: --meshServiceName
condition: selection
falsepositives:
- Environments that legitimately use MeshAgent
level: medium
license: DRL-1.1