Windows MeshAgent remote command execution via cmd.exe or PowerShell child processes
Flags cmd.exe or PowerShell spawned by meshagent.exe on Windows, indicating potential remote command execution.
- Product
- windows
- Category
- process_creation
- Author
- @Kostastsale (SigmaHQ), DRL 1.1
- Published
- 2024-09-22
- Updated
- 2026-07-30
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies process creation where MeshAgent on Windows spawns command interpreters, specifically cmd.exe, powershell.exe, or pwsh.exe. Such activity is important because MeshAgent can be used for remote execution of commands on a target host, potentially obscuring operator actions. The detection relies on process creation telemetry capturing the parent process path ending with meshagent.exe and the spawned child process image name.
Reporting behind it
- github.comhttps://github.com/Ylianst/MeshAgent
- github.comhttps://github.com/Ylianst/MeshAgent/blob/52cf129ca43d64743181fbaf940e0b4ddb542a37/modules/win-dispatcher.js#L173
- github.comhttps://github.com/Ylianst/MeshAgent/blob/52cf129ca43d64743181fbaf940e0b4ddb542a37/modules/win-info.js#L55
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_meshagent_exec.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows MeshAgent remote command execution via cmd.exe or PowerShell child processes
id: 1b34c09d-fe57-425d-93f0-b3f0e06736c7
status: test
description: This rule identifies process creation where MeshAgent on Windows spawns command interpreters, specifically cmd.exe, powershell.exe, or pwsh.exe. Such activity is important because MeshAgent can be used for remote execution of commands on a target host, potentially obscuring operator actions. The detection relies on process creation telemetry capturing the parent process path ending with meshagent.exe and the spawned child process image name.
references:
- https://github.com/Ylianst/MeshAgent
- https://github.com/Ylianst/MeshAgent/blob/52cf129ca43d64743181fbaf940e0b4ddb542a37/modules/win-dispatcher.js#L173
- https://github.com/Ylianst/MeshAgent/blob/52cf129ca43d64743181fbaf940e0b4ddb542a37/modules/win-info.js#L55
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_meshagent_exec.yml
author: "@Kostastsale, Huntrule Team"
date: 2024-09-22
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
product: windows
category: process_creation
detection:
selection:
ParentImage|endswith: \meshagent.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
condition: selection
falsepositives:
- False positives can be found in environments using MeshAgent for remote management, analysis should prioritize the grandparent process, MeshAgent.exe, and scrutinize the resulting child processes triggered by any suspicious interactive commands directed at the target host.
level: medium
license: DRL-1.1
related:
- id: 74a2b202-73e0-4693-9a3a-9d36146d0775
type: derived