CmdID

CmdID / Rules / macOS

Remote Access Tool - Renamed MeshAgent Execution - MacOS

A Sigma rule for process creation on macOS, by Norbert Jaśniewicz (AlphaSOC).

high 2 ATT&CK techniques

What it looks for

its detection, as SigmaHQ writes it
detection:
  filter_main_legitimate:
    Image|endswith:
      - '/meshagent'
      - '/meshagent_osx64'
  selection_meshagent:
    - CommandLine|contains: '--meshServiceName'
    - OriginalFileName|contains: 'meshagent'
  condition: selection_meshagent and not 1 of filter_main_*

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Norbert Jaśniewicz (AlphaSOC), under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

None of the everyday examples and documented commands on CmdID’s program pages trips it. To see whether a command line does, paste it into CmdID.

ATT&CK

the techniques it is tagged with
T1036.003Masquerading: Rename Legitimate Utilities
T1219.002Remote Access Tools: Remote Desktop Software

Other rules for T1036.003 Masquerading: Rename Legitimate Utilities

Ps.exe Renamed SysInternals Tool · File Download Via Bitsadmin · Suspicious Download From Direct IP Via Bitsadmin · Suspicious Download From File-Sharing Website Via Bitsadmin · File With Suspicious Extension Downloaded Via Bitsadmin · File Download Via Bitsadmin To A Suspicious Target Folder · Remote Access Tool - Renamed MeshAgent Execution - Windows · Potential Defense Evasion Via Binary Rename · Potential Defense Evasion Via Rename Of Highly Relevant Binaries · Renamed BrowserCore.EXE Execution · Renamed Jusched.EXE Execution · Renamed Msdt.EXE Execution