Remote Access Tool - Renamed MeshAgent Execution - MacOS

Status: experimental
Severity: high
Log source: category process_creation, product macos
Author: Norbert Jaśniewicz (AlphaSOC)
Source: github.com/SigmaHQ/sigma

Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management. However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1036.003` Masquerading: Rename Legitimate Utilities
Command & Control	`T1219.002` Remote Access Tools: Remote Desktop Software

Telemetry coverage

Platform	Record / event type
macOS	ESF event `exec` (NOTIFY): Fires after execve(2) or posix_spawn(2) succeeds, delivering a post-fact record of the new process.

Rule body

title: Remote Access Tool - Renamed MeshAgent Execution - MacOS
id: bd3b5eaa-439d-4a42-8f35-a49f5c8a2582
related:
    - id: b471f462-eb0d-4832-be35-28d94bdb4780
      type: similar
    - id: 22c45af6-f590-4d44-bab3-b5b2d2a2b6d9
      type: derived
status: experimental
description: |
    Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent.
    RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management.
    However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.
references:
    - https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access
    - https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/
    - https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/
    - https://www.security.com/threat-intelligence/medusa-ransomware-attacks
author: Norbert Jaśniewicz (AlphaSOC)
date: 2025-05-19
tags:
    - attack.command-and-control
    - attack.stealth
    - attack.t1219.002
    - attack.t1036.003
logsource:
    category: process_creation
    product: macos
detection:
    selection_meshagent:
        - CommandLine|contains: '--meshServiceName'
        - OriginalFileName|contains: 'meshagent'
    filter_main_legitimate:
        Image|endswith:
            - '/meshagent'
            - '/meshagent_osx64'
    condition: selection_meshagent and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection_meshagent and not 1 of filter_main_*

Stage 1: `selection_meshagent`

selection_meshagent:
    - CommandLine|contains: '--meshServiceName'
    - OriginalFileName|contains: 'meshagent'

Stage 2: `not filter_main_legitimate`

filter_main_legitimate:
    Image|endswith:
        - '/meshagent'
        - '/meshagent_osx64'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	ends_with	`/meshagent`	`excludes:Image` `field:"Image" value:"/meshagent"`
`Image`	ends_with	`/meshagent_osx64`	`excludes:Image` `field:"Image" value:"/meshagent_osx64"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`--meshServiceName`	`field:"CommandLine" kind:match value:"--meshServiceName"`
`OriginalFileName`	match	`meshagent`	`field:"OriginalFileName" kind:match value:"meshagent"`