MeshAgent RMM Renamed to mvtcs.exe Deployed by Settra Ransomware
Detects the execution of the MeshAgent remote management tool when renamed to 'mvtcs.exe'. This technique is often used by adversaries to maintain persistent remote access while evading basic file-name based detections.
Sigma
