Atera Agent Installation

calendar Aug 12, 2024 · attack.t1219  ·
Share on: linkedin copy

Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently found to be used by Conti operators

Sigma rule (View on GitHub)

 1title: Atera Agent Installation
 2id: 87261fb2-69d0-42fe-b9de-88c6b5f65a43
 3status: test
 4description: Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently found to be used by Conti operators
 5references:
 6    - https://www.advintel.io/post/secret-backdoor-behind-conti-ransomware-operation-introducing-atera-agent
 7author: Bhabesh Raj
 8date: 2021-09-01
 9modified: 2022-12-25
10tags:
11    - attack.t1219
12logsource:
13    service: application
14    product: windows
15detection:
16    selection:
17        EventID: 1033
18        Provider_Name: MsiInstaller
19        Message|contains: AteraAgent
20    condition: selection
21falsepositives:
22    - Legitimate Atera agent installation
23level: high

References

  • RedSense Home

    RedSense Cyber Threat Intelligence provides products and services to many of the world’s most sophisticated corporate threat intelligence departments and security organizations. As companies rethink their intelligence frameworks for greater efficacy and cost-effectiveness, RedSense evolves with them, providing innovative solutions that increase efficiency, reduce risk, and help protect organizations from substantial harm.


    Read More

Related rules

to-top