Rule Library

Sigma Rules

5 rules found for "Norbert Jaśniewicz (AlphaSOC)"

3,707Total
3,116Detection
451Emerging
137Hunting
Detectionmediumexperimental

Remote Access Tool - Potential MeshAgent Execution - MacOS

Detects potential execution of MeshAgent which is a tool used for remote access. Historical data shows that threat actors rename MeshAgent binary to evade detection. Matching command lines with the '--meshServiceName' argument can indicate that the MeshAgent is being used for remote access.

macOSProcess Creation
TA0011 · Command and Controlattack.t1219.002
Norbert Jaśniewicz (AlphaSOC)Mon May 19macos
Detectionhighexperimental

Remote Access Tool - Renamed MeshAgent Execution - MacOS

Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management. However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.

macOSProcess Creation
TA0011 · Command and ControlTA0005 · Defense Evasionattack.t1219.002T1036.003 · Rename System Utilities
Norbert Jaśniewicz (AlphaSOC)Mon May 19macos
Detectionmediumexperimental

Remote Access Tool - Potential MeshAgent Execution - Windows

Detects potential execution of MeshAgent which is a tool used for remote access. Historical data shows that threat actors rename MeshAgent binary to evade detection. Matching command lines with the '--meshServiceName' argument can indicate that the MeshAgent is being used for remote access.

WindowsProcess Creation
TA0011 · Command and Controlattack.t1219.002
Norbert Jaśniewicz (AlphaSOC)Mon May 19windows
Detectionhighexperimental

Remote Access Tool - Renamed MeshAgent Execution - Windows

Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent. RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management. However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.

WindowsProcess Creation
TA0011 · Command and ControlTA0005 · Defense Evasionattack.t1219.002T1036.003 · Rename System Utilities
Norbert Jaśniewicz (AlphaSOC)Mon May 19windows
Threat Huntmediumexperimental

Low Reputation Effective Top-Level Domain (eTLD)

Detects DNS queries to domains within known low reputation eTLDs. This rule uses AlphaSOC's threat intelligence data and is updated on a monthly basis.

dns
TA0011 · Command and ControlT1071.004 · DNSTA0001 · Initial Accessdetection.threat-hunting
Norbert Jaśniewicz (AlphaSOC)Mon Aug 04network