---
title: Suspicious MeshCentral Agent Download
id: 564d18ce-281e-4e0c-9c54-908e0940f352
description: Detects download of MeshCentral agent from suspicious domains
status: experimental
date: 2026/07/11
author: Security Arsenal
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: proxy
    product: zeek
detection:
    selection:
        uri|contains: '/agent.ashx'
        host|endswith:
            - '.net'
    filter:
        host|notcontains:
            - 'meshcentral.com'
    condition: selection and not filter
falsepositives:
    - Legitimate use of MeshCentral in educational institutions
level: high
---
title: Oracle PeopleShell Exploitation Attempt
id: a7d32a9c-f56e-4a81-b219-ec6729b67e03
description: Detects potential exploitation of CVE-2026-35273 in Oracle PeopleSoft
status: experimental
date: 2026/07/11
author: Security Arsenal
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    category: web
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - 'EnvironmentManagement'
        cs-method:
            - 'POST'
    condition: selection
falsepositives:
    - Legitimate administration of Oracle PeopleSoft
level: high
---
title: MeshCentral C2 Traffic Detection
id: 8cf3c9a7-d421-4c86-bc1d-4b4b74c8b3e5
description: Detects suspicious C2 communications associated with MeshCentral agent
status: experimental
date: 2026/07/11
author: Security Arsenal
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort: 443
        Initiated: 'true'
    filter_legitimate:
        DestinationHostname|contains:
            - 'meshcentral.com'
            - 'meshcentral.net'
    filter_ioc:
        DestinationHostname|contains:
            - 'azurenetfiles.net'
    condition: selection and not filter_legitimate or filter_ioc
falsepositives:
    - Legitimate MeshCentral usage
level: high

// Hunt for MeshCentral C2 traffic
DeviceNetworkEvents
| where Timestamp >= ago(14d)
| where RemoteUrl in ("azurenetfiles.net", "http://azurenetfiles.net:443/agent.ashx")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemotePort, RemoteIP
| order by Timestamp desc

// Hunt for potential CVE-2026-35273 exploitation attempts
DeviceNetworkEvents
| where Timestamp >= ago(14d)
| where RemoteUrl has "EnvironmentManagement" and InitiatingProcessFileName has "web" 
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RequestHeaders
| order by Timestamp desc

// Hunt for files with known malicious hashes
DeviceFileEvents
| where Timestamp >= ago(14d)
| where SHA256 in ("c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f", "2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35", "68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309")
   or MD5 == "ebcf977806f68af3147e0b78b55f6aed"
   or SHA1 == "cc19e502e4201cc974c753b96429027925224f53"
| project Timestamp, DeviceName, InitiatingProcessAccountName, FolderPath, SHA256, MD5, SHA1
| order by Timestamp desc

# MeshCentral IOC Hunt Script
# This script checks for MeshCentral artifacts and associated IOCs

# Check for known malicious file hashes
$knownHashes = @(
    "c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f",
    "2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35",
    "68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309"
)

# Check processes
Write-Host "Checking for processes with known hashes..."
$processes = Get-Process | Where-Object {$_.Path -ne $null}
foreach ($process in $processes) {
    $hash = (Get-FileHash -Path $process.Path -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
    if ($knownHashes -contains $hash) {
        Write-Host "ALERT: Process with known malicious hash found:" $process.Name $process.Path -ForegroundColor Red
    }
}

# Check files in common directories
Write-Host "Checking for files with known hashes..."
$directories = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA", "C:\ProgramData")
foreach ($dir in $directories) {
    if (Test-Path $dir) {
        $files = Get-ChildItem -Path $dir -Recurse -Include *.exe,*.dll,*.ps1,*.vbs -ErrorAction SilentlyContinue
        foreach ($file in $files) {
            $hash = (Get-FileHash -Path $file.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($knownHashes -contains $hash) {
                Write-Host "ALERT: File with known malicious hash found:" $file.FullName -ForegroundColor Red
            }
        }
    }
}

# Check for MeshCentral-related files and services
Write-Host "Checking for MeshCentral-related artifacts..."
$meshCentralFiles = @("meshagent.exe", "meshservice.exe", "MeshCentral.exe")
$services = Get-Service | Where-Object {$_.DisplayName -like "*Mesh*" -or $_.DisplayName -like "*mesh*"}
if ($services) {
    Write-Host "ALERT: Potential MeshCentral services found:" $services.DisplayName -ForegroundColor Red
}

# Check for scheduled tasks related to MeshCentral
Write-Host "Checking for MeshCentral-related scheduled tasks..."
$scheduledTasks = Get-ScheduledTask | Where-Object {$_.TaskName -like "*mesh*" -or $_.TaskName -like "*Mesh*"}
if ($scheduledTasks) {
    Write-Host "ALERT: Potential MeshCentral scheduled tasks found:" $scheduledTasks.TaskName -ForegroundColor Red
}

# Check network connections to known C2 domains
Write-Host "Checking for connections to known C2 domains..."
$c2Domains = @("azurenetfiles.net")
$connections = Get-NetTCPConnection | Where-Object {$_.State -eq "Established"}
foreach ($conn in $connections) {
    try {
        $remoteEndpoint = [System.Net.Dns]::GetHostEntry($conn.RemoteAddress)
        if ($remoteEndpoint.HostName -like "*azurenetfiles*") {
            Write-Host "ALERT: Connection to known C2 domain found:" $remoteEndpoint.HostName "PID:" $conn.OwningProcess -ForegroundColor Red
        }
    } catch {
        # If DNS resolution fails, continue
    }
}

Write-Host "IOC hunt complete."


# Response Priorities