New rules: MeshAgent arguments #5426
Conversation
github-actions
bot
added
Rules
Windows
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Welcome @norbert791 👋
It looks like this is your first pull request on the Sigma rules repository!
Please make sure to read the SigmaHQ conventions document to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.
Thanks again, and welcome to the Sigma community! 😃
| product: windows | ||
| detection: | ||
| selection: | ||
| CommandLine|windash|contains: --meshServiceName |
There was a problem hiding this comment.
| CommandLine|windash|contains: --meshServiceName | |
| CommandLine|contains|windash: --meshServiceName |
to keep the logic with the rest of the repo
There was a problem hiding this comment.
Isn't windash meant to be used for a single '-' or '/'?
if the intention to use windash is to also watch for '/meshServiceName', the windash won't do it because here is the pysigma conversion of this rule to SPL
CommandLine="*--meshServiceName*" OR CommandLine="*-/meshServiceName*" OR CommandLine="*-–meshServiceName*" OR CommandLine="*-—meshServiceName*" OR CommandLine="*-―meshServiceName*" | table CommandLine,ParentImage,Image
I'm also not sure if /meshServiceName works instead of --meshServiceName
There was a problem hiding this comment.
You're right, it's not a use case for windash.
I've verified that neither /meshServiceName nor -meshServiceName does not work instead of --meshServiceName so it can be just removed.
| - https://www.security.com/threat-intelligence/medusa-ransomware-attacks | ||
| author: Norbert Jaśniewicz (AlphaSOC) | ||
| date: 2025-05-19 | ||
| modified: 2025-05-19 |
There was a problem hiding this comment.
| modified: 2025-05-19 |
You don't need the field 'modified' for newly added rule
| modified: 2025-05-19 | ||
| tags: | ||
| - attack.command-and-control | ||
| - attack.t1219 |
There was a problem hiding this comment.
| - attack.t1219 | |
| - attack.t1219.002 |
| - https://www.security.com/threat-intelligence/medusa-ransomware-attacks | ||
| author: Norbert Jaśniewicz (AlphaSOC) | ||
| date: 2025-05-19 | ||
| modified: 2025-05-19 |
There was a problem hiding this comment.
| modified: 2025-05-19 |
| modified: 2025-05-19 | ||
| tags: | ||
| - attack.command-and-control | ||
| - attack.t1219 |
There was a problem hiding this comment.
| - attack.t1219 | |
| - attack.t1219.002 |
| product: windows | ||
| detection: | ||
| selection: | ||
| CommandLine|windash|contains: --meshServiceName |
There was a problem hiding this comment.
Isn't windash meant to be used for a single '-' or '/'?
if the intention to use windash is to also watch for '/meshServiceName', the windash won't do it because here is the pysigma conversion of this rule to SPL
CommandLine="*--meshServiceName*" OR CommandLine="*-/meshServiceName*" OR CommandLine="*-–meshServiceName*" OR CommandLine="*-—meshServiceName*" OR CommandLine="*-―meshServiceName*" | table CommandLine,ParentImage,Image
I'm also not sure if /meshServiceName works instead of --meshServiceName
| product: macos | ||
| detection: | ||
| selection: | ||
| CommandLine|contains: --meshServiceName |
There was a problem hiding this comment.
| CommandLine|contains: --meshServiceName | |
| CommandLine|contains: '--meshServiceName' |
| product: windows | ||
| detection: | ||
| selection: | ||
| CommandLine|contains: --meshServiceName |
There was a problem hiding this comment.
| CommandLine|contains: --meshServiceName | |
| CommandLine|contains: '--meshServiceName' |
There was a problem hiding this comment.
Approving it but adding the quotes for uniformity
|
We could add a |
I have added two new rules. I assume, judging by this file, that MacOS also has |
Summary of the Pull Request
This Pull Request adds two new sigma rules that might prove useful for detecting usage of renamed MeshCentral Agent (MeshAgent) binaries. Additionally, a typo from an already present rule is fixed.
Changing
new: Remote Access Tool - Potential MeshAgent Usage - MacOS
new: Remote Access Tool - Potential MeshAgent Usage - Windows
new: Remote Access Tool - Suspicious MeshAgent Usage - MacOS
new: Remote Access Tool - Suspicious MeshAgent Usage - Windows
update: Remote Access Tool - MeshAgent Command Execution via MeshCentral - typo fixed
Example Log Event
Fixed Issues
SigmaHQ Rule Creation Conventions