[WINDOWS-SECURITY] Meshagent Remote Session Interaction Service Installed

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SECURITY] Meshagent Remote Session Interaction Service Installed"; program:*Security*; event_id:7045; content:"\MeshAgent.exe"; nocase; reference:url,thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/; classtype:trojan-activity; sid:5013815; rev:1; metadata:deployment Endpoint,affected_product NONE,affected_version NONE,mitigation NONE,deprecation_reason NONE,tag NONE, created_at 2023_02_01, updated_at 2023_02_01, mitre_tactic_id TA0003, mitre_technique_id T543.003;)