RMM
MeshCentral
MeshCentral is a remote monitoring and management (RMM) tool. MeshAgent used along with MeshCentral to remotely manage computers. MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes.
Tool overview
- Category
- RMM
- Research authors
- @kostastsale
- Created
- 2024-09-20
- Last modified
- 2024-09-20
- Privileges
- SYSTEM
- Free / availability
- Yes
- Verification required
- N/A
- Supported platforms
- FreeBSD
Linux
Windows
macOS
Capabilities
Known vulnerabilities
- CVE-2024-26135
Executables & installation paths
- Filename
- MeshAgent.exe
- OriginalFileName
- Not recorded
- Description
- MeshCentral Background Service Agent
Installation paths
meshcentral*.exe
meshagent*.exe
/usr/local/mesh_services/meshagent/meshagent/*
/usr/local/mesh_services/meshagent/*
Code signing
- signer name
- MOONWHITE TECHNOLOGIES PRIVATE LIMITED
- certificate thumbprint
- 4E5AB3CC60B41C9C9C218B8C272786ED0E6D8990
- src file sha256
- 729f6286b503b36b45fb86efdf7a2e148713c1999a0a98fb485e72188ae26bdf
- src file path
- downloaded_files/meshcentral/729f6286b503b36b45fb86efdf7a2e148713c1999a0a98fb485e72188ae26bdf
FORENSIC EVIDENCE
Disk artifacts
- File
- C:\Program Files\Mesh Agent\MeshAgent.exe
- Description
- Local MeshAgent service binary after installation
- OS
- Windows
- File
- C:\Program Files\Mesh Agent\MeshAgent.msh
- Description
- Local MeshAgent service configuration file. Contains configuration settings including the MeshCentral server address, port, and other settings. If the MeshAgent is run without being installed, the configuration file is created in the same directory as the MeshAgent binary.
- OS
- Windows
- File
- /usr/local/mesh_services/meshagent/meshagent/meshagent
- Description
- Local MeshAgent service binary after installation
- OS
- MacOS
- File
- /usr/local/mesh_services/meshagent/meshagent/meshagent.db
- Description
- Local Meshagent database after installation
- OS
- MacOS
- File
- /usr/local/mesh_services/meshagent/meshagent/meshagent.msh
- Description
- Local Meshagent databconfiguration file after installation
- OS
- MacOS
- File
- /usr/local/mesh_services/meshagent/meshagent
- Description
- Local MeshAgent service binary after installation
- OS
- Linux
- File
- /usr/local/mesh_services/meshagent/meshagent.db
- Description
- Local Meshagent database after installation
- OS
- Linux
- File
- /usr/local/mesh_services/meshagent/meshagent.msh
- Description
- Local Meshagent databconfiguration file after installation
- OS
- Linux
FORENSIC EVIDENCE
Event log artifacts
- EventID
- 7045
- ProviderName
- Service Control Manager
- LogFile
- System.evtx
- ServiceName
- Mesh Agent background service
- ImagePath
- "C:\\Program Files\\Mesh Agent\\MeshAgent.exe"
- Description
- Service installation event as result of MeshAgent installation.
FORENSIC EVIDENCE
Network artifacts
- Description
- Known remote domains
- Domains
- user_managed
- meshcentral.com
- Ports
- Not recorded
Detections
- Sigma
- https://github.com/tsale/Sigma_rules/blob/main/Threat%20Hunting%20Queries/proc_creation_windows_meshagent.yml
- Description
- Detects MeshAgent Command Execution via MeshCentral
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/meshcentral_network_sigma.yml
- Description
- Detects potential network activity of MeshCentral RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/meshcentral_files_sigma.yml
- Description
- Detects potential files activity of MeshCentral RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/meshcentral_processes_sigma.yml
- Description
- Detects potential processes activity of MeshCentral RMM tool
References
Acknowledgements
- Person
- Kostas
- Handle
- @kostastsale