macOS Process Creation: MeshAgent renamed execution via --meshServiceName
Identifies macOS executions of MeshAgent instances that include --meshServiceName, indicating potential renamed remote access tooling.
- Product
- macos
- Category
- process_creation
- Author
- Norbert Jaśniewicz (AlphaSOC) (SigmaHQ), DRL 1.1
- Published
- 2025-05-19
- Updated
- 2026-07-31
ATT&CK techniques
Defense Evasion → C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags macOS process creation events where the command line contains the MeshAgent-specific parameter "--meshServiceName" while the process appears to be a renamed instance of MeshAgent. Attackers may rename RMM tooling to evade allowlists and simple detections, which can enable persistent remote control. The detection relies on process_creation telemetry, matching the command-line argument and excluding known legitimate MeshAgent paths via image filename endings.
Reporting behind it
- huntress.comhttps://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access
- thecyberexpress.comhttps://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/
- wazuh.comhttps://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/
- security.comhttps://www.security.com/threat-intelligence/medusa-ransomware-attacks
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_remote_access_tools_renamed_meshagent_execution.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "macOS Process Creation: MeshAgent renamed execution via --meshServiceName"
id: 4bb39182-9c28-4cac-9fb4-c81ce181e12d
related:
- id: b471f462-eb0d-4832-be35-28d94bdb4780
type: similar
- id: 22c45af6-f590-4d44-bab3-b5b2d2a2b6d9
type: derived
- id: bd3b5eaa-439d-4a42-8f35-a49f5c8a2582
type: derived
status: experimental
description: This rule flags macOS process creation events where the command line contains the MeshAgent-specific parameter "--meshServiceName" while the process appears to be a renamed instance of MeshAgent. Attackers may rename RMM tooling to evade allowlists and simple detections, which can enable persistent remote control. The detection relies on process_creation telemetry, matching the command-line argument and excluding known legitimate MeshAgent paths via image filename endings.
references:
- https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access
- https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/
- https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/
- https://www.security.com/threat-intelligence/medusa-ransomware-attacks
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_remote_access_tools_renamed_meshagent_execution.yml
author: Norbert Jaśniewicz (AlphaSOC), Huntrule Team
date: 2025-05-19
tags:
- attack.command-and-control
- attack.stealth
- attack.t1219.002
- attack.t1036.003
logsource:
category: process_creation
product: macos
detection:
selection_meshagent:
- CommandLine|contains: --meshServiceName
- OriginalFileName|contains: meshagent
filter_main_legitimate:
Image|endswith:
- /meshagent
- /meshagent_osx64
condition: selection_meshagent and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1