norbert791 639a948bae Merge PR #5426 from @norbert791 - New rules: Remote Access Tool MeshAgent ...

new: Remote Access Tool - Potential MeshAgent Usage - MacOS
new: Remote Access Tool - Potential MeshAgent Usage - Windows
new: Remote Access Tool - Suspicious MeshAgent Usage - MacOS
new: Remote Access Tool - Suspicious MeshAgent Usage - Windows
chore: Remote Access Tool - MeshAgent Command Execution via MeshCentral - typo fixed
---------

Co-authored-by: Norbert Jaśniewicz <norbert.jasniewicz@alphasoc.com>
Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>

2025-06-24 11:19:53 +02:00

..

proc_creation_macos_applescript.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_base64_decode.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_binary_padding.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_change_file_time_attr.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_chflags_hidden_flag.yml

Merge PR #5390 from @david-syk - Update MITRE ATT&CK tags

2025-05-20 23:08:57 +02:00

proc_creation_macos_clear_system_logs.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_clipboard_data_via_osascript.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_create_account.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_create_hidden_account.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_creds_from_keychain.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_csrutil_disable.yml

Merge PR #5065 from @nasbench - Promote older rules status from experimental to test

2024-11-01 10:21:04 +01:00

proc_creation_macos_csrutil_status.yml

Merge PR #5065 from @nasbench - Promote older rules status from experimental to test

2024-11-01 10:21:04 +01:00

proc_creation_macos_disable_security_tools.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_dscl_add_user_to_admin_group.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_dseditgroup_add_to_admin_group.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_dsenableroot_enable_root_account.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_file_and_directory_discovery.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_find_cred_in_files.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_gui_input_capture.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_hdiutil_create.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_hdiutil_mount.yml

Merge PR #5388 from @david-syk - Update MITRE ATT&CK tags

2025-05-20 23:09:23 +02:00

proc_creation_macos_installer_susp_child_process.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_ioreg_discovery.yml

Merge PR #5065 from @nasbench - Promote older rules status from experimental to test

2024-11-01 10:21:04 +01:00

proc_creation_macos_jamf_susp_child.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_jamf_usage.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_jxa_in_memory_execution.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_launchctl_execution.yml

Merge PR #5249 from @nasbench - Promote older rules status from experimental to test

2025-04-17 00:41:35 +02:00

proc_creation_macos_local_account.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_local_groups.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_network_service_scanning.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_network_sniffing.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_nscurl_usage.yml

Merge PR #5249 from @nasbench - Promote older rules status from experimental to test

2025-04-17 00:41:35 +02:00

proc_creation_macos_office_susp_child_processes.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_osacompile_runonly_execution.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_payload_decoded_and_decrypted.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_persistence_via_plistbuddy.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_remote_access_tools_meshagent_arguments.yml

Merge PR #5426 from @norbert791 - New rules: Remote Access Tool MeshAgent

2025-06-24 11:19:53 +02:00

proc_creation_macos_remote_access_tools_renamed_meshagent_execution.yml

Merge PR #5426 from @norbert791 - New rules: Remote Access Tool MeshAgent

2025-06-24 11:19:53 +02:00

proc_creation_macos_remote_access_tools_teamviewer_incoming_connection.yml

Merge PR #5177 from @nasbench - promote older rules status from experimental to test

2025-02-03 18:23:12 +01:00

proc_creation_macos_remote_system_discovery.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_schedule_task_job_cron.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_screencapture.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_security_software_discovery.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_space_after_filename.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_split_file_into_pieces.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_susp_browser_child_process.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_susp_execution_macos_script_editor.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_susp_find_execution.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_susp_histfile_operations.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_susp_in_memory_download_and_compile.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_susp_macos_firmware_activity.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_susp_system_network_discovery.yml

Merge PR #4987 from @peterydzynski - Fix System Network Discovery - macOS

2024-08-29 20:30:47 +02:00

proc_creation_macos_suspicious_applet_behaviour.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_swvers_discovery.yml

Merge PR #5065 from @nasbench - Promote older rules status from experimental to test

2024-11-01 10:21:04 +01:00

proc_creation_macos_sysadminctl_add_user_to_admin_group.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_sysadminctl_enable_guest_account.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_sysctl_discovery.yml

Merge PR #5249 from @nasbench - Promote older rules status from experimental to test

2025-04-17 00:41:35 +02:00

proc_creation_macos_system_network_connections_discovery.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_system_profiler_discovery.yml

Merge PR #5065 from @nasbench - Promote older rules status from experimental to test

2024-11-01 10:21:04 +01:00

proc_creation_macos_system_shutdown_reboot.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_tail_base64_decode_from_image.yml

Merge PR #5065 from @nasbench - Promote older rules status from experimental to test

2024-11-01 10:21:04 +01:00

proc_creation_macos_tmutil_delete_backup.yml

Merge PR #5249 from @nasbench - Promote older rules status from experimental to test

2025-04-17 00:41:35 +02:00

proc_creation_macos_tmutil_disable_backup.yml

Merge PR #5249 from @nasbench - Promote older rules status from experimental to test

2025-04-17 00:41:35 +02:00

proc_creation_macos_tmutil_exclude_file_from_backup.yml

Merge PR #5249 from @nasbench - Promote older rules status from experimental to test

2025-04-17 00:41:35 +02:00

proc_creation_macos_wizardupdate_malware_infection.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_xattr_gatekeeper_bypass.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00

proc_creation_macos_xcsset_malware_infection.yml

Merge PR #4950 from @nasbench - Comply With v2 Spec Changes

2024-08-12 12:02:50 +02:00