CVE-2024-21762 FortiGate SSL-VPN Exploitation + MeshCentral RMM Persistence: Thai Telecom Intrusion — OTX Detection Pack

---
title: FortiGate SSL-VPN CVE-2024-21762 Exploitation Attempt
id: 8f2a1c4d-7e3b-4a9f-b1c2-9d5e6f7a8b9c
status: experimental
description: Detects exploitation attempts against FortiGate SSL-VPN via CVE-2024-21762 patterns — oversized/crafted HTTP requests to sslvpnd endpoints, followed by anomalous process spawning on the appliance or crash artifacts.
author: Security Arsenal Threat Intelligence
date: 2026/09/15
references:
    - https://hunt.io/blog/thai-broadband-fortigate-sslvpn-meshcentral-intrusion
    - https://www.fortiguard.com/psirt/FG-IR-24-015
logsource:
    category: webserver
    product: fortigate
detection:
    selection_uri:
        cs_uri|contains:
            - '/remote/hostcheck_validate'
            - '/remote/info'
            - '/remote/logincheck'
            - '/sslvpn/portal/'
    selection_size:
        Content_Length|gte: 1500
    selection_method:
        cs_method: 'POST'
    condition: selection_uri and selection_size and selection_method
falsepositives:
    - Legitimate SSL-VPN authentication flows (filter known-good client source ranges)
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2024-21762
---
title: MeshCentral RMM Agent Installation and Execution
id: 3b7d9e1f-2a4c-4d8e-9f0a-1b2c3d4e5f6a
status: experimental
description: Detects installation or execution of MeshCentral MeshAgent — legitimate RMM tooling abused for covert C2, as observed in the 3BB telecom intrusion. Alerts on service installation, binary execution, and characteristic child process behavior.
author: Security Arsenal Threat Intelligence
date: 2026/09/15
references:
    - https://hunt.io/blog/thai-broadband-fortigate-sslvpn-meshcentral-intrusion
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
            - '\MeshAgent.exe'
            - '\meshagent64.exe'
            - '\meshagent32.exe'
        - OriginalFileName: 'MeshAgent.exe'
    selection_service:
        ParentImage|endswith: '\services.exe'
        CommandLine|contains: 'mesh'
    condition: selection_img or selection_service
falsepositives:
    - Organizations legitimately using MeshCentral for IT management (maintain an approved-server allowlist and alert on deviations)
level: high
tags:
    - attack.command_and_control
    - attack.t1219
    - attack.persistence
    - attack.t1543.003
---
title: Outbound Connection to Known 3BB Intrusion Infrastructure
id: 5c1e8a2b-6d3f-4b7a-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects DNS resolution or network connections to infrastructure identified in the OTX pulse covering the Thai broadband FortiGate/MeshCentral intrusion.
author: Security Arsenal Threat Intelligence
date: 2026/09/15
references:
    - https://hunt.io/blog/thai-broadband-fortigate-sslvpn-meshcentral-intrusion
logsource:
    category: dns
detection:
    selection:
        query|contains:
            - 'agent.3bb.co.th'
            - 'www.ayuthayatech.com'
    condition: selection
falsepositives:
    - Unlikely outside of research/threat hunting activity
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001

// Hunt: MeshCentral RMM abuse + 3BB intrusion IOCs (Microsoft Sentinel / Defender XDR)
// Looks for MeshAgent execution, connections to pulse IOCs, and unexpected RMM-style TLS egress
let Lookback = 30d;
let SuspiciousIPs = dynamic(["92.63.180.133", "110.164.129.67", "110.164.192.228", "110.164.58.195"]);
let SuspiciousHosts = dynamic(["agent.3bb.co.th", "www.ayuthayatech.com", "mail.3bb.co.th"]);
let NetworkHits =
    DeviceNetworkEvents
    | where Timestamp > ago(Lookback)
    | where RemoteIP in (SuspiciousIPs) or RemoteUrl has_any (SuspiciousHosts)
    | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
              RemoteIP, RemoteUrl, RemotePort, ActionType
    | extend Detection = "IOC Network Match";
let MeshAgentExec =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where FileName has_any ("MeshAgent", "meshagent64", "meshagent32")
       or ProcessCommandLine has_any ("meshcentral", "MeshAgent.exe")
    | project Timestamp, DeviceName, FileName, ProcessCommandLine, FolderPath,
              InitiatingProcessFileName, AccountName
    | extend Detection = "MeshCentral Agent Execution";
let MeshServiceInstall =
    DeviceEvents
    | where Timestamp > ago(Lookback)
    | where ActionType == "ServiceInstalled"
    | where AdditionalFields has "mesh"
    | project Timestamp, DeviceName, FileName, AdditionalFields
    | extend Detection = "Mesh Service Installed";
union NetworkHits, MeshAgentExec, MeshServiceInstall
| sort by Timestamp desc

# ============================================================
# Hunt Script: FortiGate/MeshCentral Intrusion Artifacts
# Checks for MeshAgent services, persistence, IOC connections
# Run elevated on Windows endpoints/servers
# ============================================================

$Report = @()

# --- 1. MeshCentral agent services and processes ---
$meshServices = Get-CimInstance Win32_Service -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -match 'mesh' -or $_.PathName -match 'MeshAgent' }
foreach ($svc in $meshServices) {
    $Report += [pscustomobject]@{
        Category = 'Suspicious Service'
        Finding  = "$($svc.Name) | $($svc.State) | $($svc.PathName)"
        Host     = $env:COMPUTERNAME
    }
}

$meshProcs = Get-Process -ErrorAction SilentlyContinue |
    Where-Object { $_.ProcessName -match 'meshagent' }
foreach ($p in $meshProcs) {
    $Report += [pscustomobject]@{
        Category = 'Running MeshAgent Process'
        Finding  = "$($p.ProcessName) PID=$($p.Id) Path=$($p.Path)"
        Host     = $env:COMPUTERNAME
    }
}

# --- 2. Persistence: Run keys and scheduled tasks referencing Mesh ---
$runPaths = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
              'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($path in $runPaths) {
    if (Test-Path $path) {
        (Get-ItemProperty $path).PSObject.Properties |
            Where-Object { $_.Value -match 'meshagent|meshcentral' } |
            ForEach-Object {
                $Report += [pscustomobject]@{
                    Category = 'Registry Persistence'
                    Finding  = "$path :: $($_.Name) = $($_.Value)"
                    Host     = $env:COMPUTERNAME
                }
            }
    }
}

Get-ScheduledTask -ErrorAction SilentlyContinue |
    Where-Object { ($_.Actions.Execute -match 'mesh') -or ($_.TaskName -match 'mesh') } |
    ForEach-Object {
        $Report += [pscustomobject]@{
            Category = 'Scheduled Task Persistence'
            Finding  = "$($_.TaskName) -> $($_.Actions.Execute)"
            Host     = $env:COMPUTERNAME
        }
    }

# --- 3. Network connections to OTX pulse IOCs ---
$badIPs  = @('92.63.180.133','110.164.129.67','110.164.192.228','110.164.58.195')
$badFqdn = @('agent.3bb.co.th','www.ayuthayatech.com','mail.3bb.co.th')

Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $badIPs -contains $_.RemoteAddress } |
    ForEach-Object {
        $proc = (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName
        $Report += [pscustomobject]@{
            Category = 'IOC Network Connection (ACTIVE)'
            Finding  = "$($_.RemoteAddress):$($_.RemotePort) via $proc"
            Host     = $env:COMPUTERNAME
        }
    }

foreach ($fqdn in $badFqdn) {
    try {
        $r = Resolve-DnsName $fqdn -ErrorAction Stop
        $Report += [pscustomobject]@{
            Category = 'IOC DNS Resolution'
            Finding  = "$fqdn resolves: $($r.IPAddress -join ',')"
            Host     = $env:COMPUTERNAME
        }
    } catch {}
}

# --- 4. MeshAgent install directories ---
$meshDirs = @("$env:ProgramFiles\Mesh Agent", "${env:ProgramFiles(x86)}\Mesh Agent",
              "$env:ProgramData\MeshAgent", "$env:windir\Temp\mesh")
foreach ($d in $meshDirs) {
    if (Test-Path $d) {
        $Report += [pscustomobject]@{
            Category = 'MeshAgent Directory Found'
            Finding  = $d
            Host     = $env:COMPUTERNAME
        }
    }
}

if ($Report.Count -eq 0) {
    Write-Output "[CLEAN] No MeshCentral/IOC artifacts found on $env:COMPUTERNAME"
} else {
    $Report | Format-Table -AutoSize
    $Report | Export-Csv -Path ".\mesh_hunt_$env:COMPUTERNAME.csv" -NoTypeInformation
    Write-Warning "$($Report.Count) suspicious artifact(s) found. CSV exported."
}