Windows MeshAgent remote command execution via cmd.exe or PowerShell child processes

Flags cmd.exe or PowerShell spawned by meshagent.exe on Windows, indicating potential remote command execution.

FreeUnreviewedSigmamediumv1

windows-meshagent-remote-command-execution-via-cmd-exe-or-powershell-child-proce-74a2b202

title: Windows MeshAgent remote command execution via cmd.exe or PowerShell child processes
id: 1b34c09d-fe57-425d-93f0-b3f0e06736c7
status: test
description: This rule identifies process creation where MeshAgent on Windows spawns command interpreters, specifically cmd.exe, powershell.exe, or pwsh.exe. Such activity is important because MeshAgent can be used for remote execution of commands on a target host, potentially obscuring operator actions. The detection relies on process creation telemetry capturing the parent process path ending with meshagent.exe and the spawned child process image name.
references:
  - https://github.com/Ylianst/MeshAgent
  - https://github.com/Ylianst/MeshAgent/blob/52cf129ca43d64743181fbaf940e0b4ddb542a37/modules/win-dispatcher.js#L173
  - https://github.com/Ylianst/MeshAgent/blob/52cf129ca43d64743181fbaf940e0b4ddb542a37/modules/win-info.js#L55
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_meshagent_exec.yml
author: "@Kostastsale, Huntrule Team"
date: 2024-09-22
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith: \meshagent.exe
    Image|endswith:
      - \cmd.exe
      - \powershell.exe
      - \pwsh.exe
  condition: selection
falsepositives:
  - False positives can be found in environments using MeshAgent for remote management, analysis should prioritize the grandparent process, MeshAgent.exe, and scrutinize the resulting child processes triggered by any suspicious interactive commands directed at the target host.
level: medium
license: DRL-1.1
related:
  - id: 74a2b202-73e0-4693-9a3a-9d36146d0775
    type: derived

What it detects

This rule identifies process creation where MeshAgent on Windows spawns command interpreters, specifically cmd.exe, powershell.exe, or pwsh.exe. Such activity is important because MeshAgent can be used for remote execution of commands on a target host, potentially obscuring operator actions. The detection relies on process creation telemetry capturing the parent process path ending with meshagent.exe and the spawned child process image name.

Known false positives

False positives can be found in environments using MeshAgent for remote management, analysis should prioritize the grandparent process, MeshAgent.exe, and scrutinize the resulting child processes triggered by any suspicious interactive commands directed at the target host.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.