Sigma rule: Remote Access Tool - Renamed MeshAgent Execution - MacOS

Rule

Title

Remote Access Tool - Renamed MeshAgent Execution - MacOS

Status

experimental

Level

high

Author

Norbert Jaśniewicz (AlphaSOC)

Date

2025-05-19

File

rules/macos/process_creation/proc_creation_macos_remote_access_tools_renamed_meshagent_execution.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent.
RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management.
However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.

Log source

product

macos

category

process_creation

Detection

selection_meshagent:
    - CommandLine|contains: '--meshServiceName'
    - OriginalFileName|contains: 'meshagent'
filter_main_legitimate:
    Image|endswith:
        - '/meshagent'
        - '/meshagent_osx64'
condition: selection_meshagent and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.command-and-control
• attack.stealth
• attack.t1219.002
• attack.t1036.003

MITRE ATT&CK ids this rule names

• T1036.003
• T1219.002

Related rules

• b471f462-eb0d-4832-be35-28d94bdb4780 (similar)
• 22c45af6-f590-4d44-bab3-b5b2d2a2b6d9 (derived)

References

• https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access
• https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/
• https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/
• https://www.security.com/threat-intelligence/medusa-ransomware-attacks

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/macos/process_creation/proc_creation_macos_remote_access_tools_renamed_meshagent_execution.yml