{
  "Name": "MeshCentral",
  "Category": "RMM",
  "Description": "MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes.\n",
  "Author": "@kostastsale",
  "Created": "2024-09-20",
  "LastModified": "2024-09-20",
  "Details": {
    "Website": "https://meshcentral.com/",
    "PEMetadata": {
      "Filename": "MeshAgent.exe",
      "OriginalFileName": "",
      "Description": "MeshCentral Background Service Agent"
    },
    "Privileges": "SYSTEM",
    "Free": "Yes",
    "Verification": "N/A",
    "SupportedOS": [
      "Windows",
      "Linux",
      "MacOS",
      "FreeBSD"
    ],
    "Capabilities": [
      "Remote Desktop & Terminal",
      "Remote File Access",
      "Text and Voice Chat",
      "Server File Storage",
      "Real-time User interface",
      "Port Forwarding"
    ],
    "Vulnerabilities": [
      "CVE-2024-26135"
    ],
    "InstallationPaths": [
      "meshcentral*.exe",
      "meshagent*.exe",
      "/usr/local/mesh_services/meshagent/meshagent/*",
      "/usr/local/mesh_services/meshagent/*"
    ]
  },
  "Artifacts": {
    "Disk": [
      {
        "File": "C:\\Program Files\\Mesh Agent\\MeshAgent.exe",
        "Description": "Local MeshAgent service binary after installation",
        "OS": "Windows"
      },
      {
        "File": "C:\\Program Files\\Mesh Agent\\MeshAgent.msh",
        "Description": "Local MeshAgent service configuration file. Contains configuration settings including the MeshCentral server address, port, and other settings. If the MeshAgent is run without being installed, the configuration file is created in the same directory as the MeshAgent binary.",
        "OS": "Windows"
      },
      {
        "File": "/usr/local/mesh_services/meshagent/meshagent/meshagent",
        "Description": "Local MeshAgent service binary after installation",
        "OS": "MacOS"
      },
      {
        "File": "/usr/local/mesh_services/meshagent/meshagent/meshagent.db",
        "Description": "Local Meshagent database after installation",
        "OS": "MacOS"
      },
      {
        "File": "/usr/local/mesh_services/meshagent/meshagent/meshagent.msh",
        "Description": "Local Meshagent databconfiguration file after installation",
        "OS": "MacOS"
      },
      {
        "File": "/usr/local/mesh_services/meshagent/meshagent",
        "Description": "Local MeshAgent service binary after installation",
        "OS": "Linux"
      },
      {
        "File": "/usr/local/mesh_services/meshagent/meshagent.db",
        "Description": "Local Meshagent database after installation",
        "OS": "Linux"
      },
      {
        "File": "/usr/local/mesh_services/meshagent/meshagent.msh",
        "Description": "Local Meshagent databconfiguration file after installation",
        "OS": "Linux"
      }
    ],
    "EventLog": [
      {
        "EventID": 7045,
        "ProviderName": "Service Control Manager",
        "LogFile": "System.evtx",
        "ServiceName": "Mesh Agent background service",
        "ImagePath": "\"C:\\\\Program Files\\\\Mesh Agent\\\\MeshAgent.exe\"",
        "Description": "Service installation event as result of MeshAgent installation."
      }
    ],
    "Network": [
      {
        "Description": "Known remote domains",
        "Domains": [
          "user_managed",
          "meshcentral.com"
        ],
        "Ports": []
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/tsale/Sigma_rules/blob/main/Threat%20Hunting%20Queries/proc_creation_windows_meshagent.yml",
      "Description": "Detects MeshAgent Command Execution via MeshCentral"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/meshcentral_network_sigma.yml",
      "Description": "Detects potential network activity of MeshCentral RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/meshcentral_files_sigma.yml",
      "Description": "Detects potential files activity of MeshCentral RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/meshcentral_processes_sigma.yml",
      "Description": "Detects potential processes activity of MeshCentral RMM tool"
    }
  ],
  "References": [
    "https://ylianst.github.io/MeshCentral/meshcentral/",
    "https://github.com/Ylianst/MeshAgent"
  ],
  "Acknowledgement": [
    {
      "Person": "Kostas",
      "Handle": "@kostastsale"
    }
  ],
  "CodeSigning": {
    "certificates": [
      {
        "signer_name": "MOONWHITE TECHNOLOGIES PRIVATE LIMITED",
        "certificate_thumbprint": "4E5AB3CC60B41C9C9C218B8C272786ED0E6D8990",
        "certificate_der_base64": "MIIHmDCCBYCgAwIBAgIMKvPacCP9l5y1Z79+MA0GCSqGSIb3DQEBCwUAMFwxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMTIwMAYDVQQDEylHbG9iYWxTaWduIEdDQyBSNDUgRVYgQ29kZVNpZ25pbmcgQ0EgMjAyMDAeFw0yNTExMjcwOTI3NTVaFw0yNjExMjgwOTI3NTVaMIH9MR0wGwYDVQQPDBRQcml2YXRlIE9yZ2FuaXphdGlvbjEeMBwGA1UEBRMVVTcyOTAwS0wyMDIxUFRDMDY4MzQ0MRMwEQYLKwYBBAGCNzwCAQMTAklOMRcwFQYLKwYBBAGCNzwCAQITBktlcmFsYTELMAkGA1UEBhMCSU4xDzANBgNVBAgTBktlcmFsYTEOMAwGA1UEBxMFS29jaGkxLzAtBgNVBAoTJk1PT05XSElURSBURUNITk9MT0dJRVMgUFJJVkFURSBMSU1JVEVEMS8wLQYDVQQDEyZNT09OV0hJVEUgVEVDSE5PTE9HSUVTIFBSSVZBVEUgTElNSVRFRDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMONPOxf2mHAQvxyBUyl28OaYVG7kpLuEb5hA7OocDkK2Zd4eGFr0GTBht2dhCu+EHK5RvOpsOKZ5caIufuwnNb3Gi0Gc2c8SdgKW7Jr4q6sDsPYw5JDnVW4eHUAVx42VLbc8m71SB3URA+lFnjGVyQWb1o+jY+f3Ftzga2CEQ7u8I3HgyFW29gU97cKyAbuwDL4TFD7le5lt4ZwwUX/LB/W4h2JQpBatJTmVMbVXz3gc4MzzrbRBzzbXjzFyhQ71zOJWj/rLrcwK4jHYxKPdtzI9eNGw+GgfbT/azL5lIbRlY+sTmM+w6IdbwjixAuhCEF3cWKFVwhI75AEsvMOfGZxqQrzDw2ktSa0tPpbXjEx13LuYmL942mn8b++xLDnc4f9NEVOvviqAcagKI8qJSOH4g6ftIBfiIbRCoT0Xen9g0xZyeEBNJkb13Kep3fFY919BbwZDZzo6KaivJAxkBLMtGaawoO3uIrhPiIBD5Nge9mLg1tL9KEOoFVLypTFAlNKokxjKCUKKn/eWpIA9edq33CezjrSRVTurtrhZm3NU4xXctd4o2Z9hd6uGru/KS/4G7gpisMgY/WN9doN+YDvarxf2NS1gPQqG9CM8J5CmW2Gsn26JoUtCTBs2EoPYbm1MA4G94uuy2gIR/IyMg7BJ+9O/PvqdAa6kxNLIcWnAgMBAAGjggG2MIIBsjAOBgNVHQ8BAf8EBAMCB4AwgZ8GCCsGAQUFBwEBBIGSMIGPMEwGCCsGAQUFBzAChkBodHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24uY29tL2NhY2VydC9nc2djY3I0NWV2Y29kZXNpZ25jYTIwMjAuY3J0MD8GCCsGAQUFBzABhjNodHRwOi8vb2NzcC5nbG9iYWxzaWduLmNvbS9nc2djY3I0NWV2Y29kZXNpZ25jYTIwMjAwVQYDVR0gBE4wTDBBBgkrBgEEAaAyAQIwNDAyBggrBgEFBQcCARYmaHR0cHM6Ly93d3cuZ2xvYmFsc2lnbi5jb20vcmVwb3NpdG9yeS8wBwYFZ4EMAQMwCQYDVR0TBAIwADBHBgNVHR8EQDA+MDygOqA4hjZodHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL2dzZ2NjcjQ1ZXZjb2Rlc2lnbmNhMjAyMC5jcmwwEwYDVR0lBAwwCgYIKwYBBQUHAwMwHwYDVR0jBBgwFoAUJZ3Q/FkJhmPF7POxEztXHAOSNhEwHQYDVR0OBBYEFKQ1L/2Nv3p78wv8ENUMoS3G6p8qMA0GCSqGSIb3DQEBCwUAA4ICAQCkD8MCK7rDiYfNP7O7trx1qCnCyuyNKKBLyyBSiJFyrgbU+xT852+l7dr8qUIpDdTM77brkA3tDO+sdotmrS2kKInazl7usbufbPx6f8IZJyp6Fh5Qf8ST7rNs/qNP6A3F7I/nuWN71CbEDMTJPSOUS3QOG58iCEuCIqFXU7MJkM9Iur3FkdCLjL1UmeA3jd+VHaQkndad/Gd25LVIQkX/nZd9KCZF/9E0yi+b8UN68SxUvTxVg/KJA+kqwoqAIkM1W5Q3SPzAx1p26zIGPwyOl+5FhdNCfE+whoH/VjXBANaS5wR8WxJnAh+4blymYLKqL01SWo98NiLrFXLLvQmhO2LO1XaBVw0dfB5vufuwfj3tF8zYFzt/w/9pofRzSDTeBBfPvHtFqziWFa4vPXjQhSVO6q3BfuL4rMaYiSLBK5e2x5+WzSxfMTXDiDXqZftArOLva+JDDrMhCqjiNjmjgNyKBgZAJvGHLO1GnAXKFvznzWEr8DVLRD5N5U+jfLXxezSfzQOb5LJCvK7LESddcpPNwcN+duVf0ZJvBQmrqFWw3kUgSY09WixYthhTPl/ayBjU7ML5N8yh+/T9iJ3R9EnJ5iOSX0oES07Hlw1R+swoMRePtot9/DGmjqJPq6M+UrgSTvspli/0Y4EnWZdBFUtRPsAYz7qYK3gGgJkOHw==",
        "src_file_sha256": "729f6286b503b36b45fb86efdf7a2e148713c1999a0a98fb485e72188ae26bdf",
        "src_file_path": "downloaded_files/meshcentral/729f6286b503b36b45fb86efdf7a2e148713c1999a0a98fb485e72188ae26bdf"
      }
    ]
  }
}