MeshAgent RMM renamed masquerade or Settra C2 IP contact
This rule monitors for potential MeshAgent activity associated with the Settra threat actor. It identifies processes that are likely renamed instances of MeshAgent (via metadata inspection), processes attempting to communicate with known C2 IP addresses, and direct network connections to these C2 IP addresses.
Microsoft Sentinel (KQL)
