Suspicious Remote Access Utility - MeshAgent Command Execution via MeshCentral (via process_creation)

title: Suspicious Remote Access Utility - MeshAgent Command Execution via MeshCentral (via process_creation)
id: b5c690c2-d22c-5db0-b217-08f4d8c7a397
status: stable
description: This rule detects the use of MeshAgent to execute commands on the target host, particularly when threat actors might misuse it to execute commands directly. MeshAgent can execute commands on the target host by abusing win-console to obscure their activities and win-dispatcher to run hostile code through IPC with child processes.
references:
    - https://attack.mitre.org/techniques/T1219/002/
    - https://github.com/Ylianst/MeshAgent
    - https://github.com/Ylianst/MeshAgent/blob/52cf129ca43d64743181fbaf940e0b4ddb542a37/modules/win-dispatcher.js#L173
    - https://github.com/Ylianst/MeshAgent/blob/52cf129ca43d64743181fbaf940e0b4ddb542a37/modules/win-info.js#L55
author: 'Huntrule Team'
date: 2026-03-11
tags:
    - attack.command-and-control
    - attack.t1219.002
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        ParentImage|endswith: '\meshagent.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
    condition: selection
falsepositives:
    - Unknown
level: medium