Atera Agent Installation

Title: Atera Agent Installation
Status: test
Description:Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently found to be used by Conti operators
References:
  -https://www.advintel.io/post/secret-backdoor-behind-conti-ransomware-operation-introducing-atera-agent
Author: Bhabesh Raj
Date: 2021-09-01
modified:2022-12-25
Tags:

• -'attack.command-and-control'
• -'attack.t1219.002'

Logsource:

• service: application
• product: windows

Detection:
  selection:
    EventID: '1033'
    Provider_Name: 'MsiInstaller'
    Message|contains: 'AteraAgent'
  condition:selection
Falsepositives:
  -Legitimate Atera agent installation
Level: high