huntrule

Malicious Local Administrator Added by Atera RMM Agent

PremiumReviewedSigma · High · v1
Category
process_creation
Author
HuntRule
Published
2026-05-22
Updated
2026-08-28
AnalysisDetection

ATT&CK techniques

Initial Access → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects the AteraAgent process spawning net.exe to add an account to the local administrators group, an abuse chain Huntress observed during bulk attacks leveraging RMM tools against MSP-managed endpoints. Attackers who gain access to an RMM tenant push commands that create privileged accounts for persistence. Privileged account changes originating from an RMM agent are a strong indicator of tenant abuse.

Reporting behind it

Related detections9 linkedT1078 — drag to rearrange
Suspicious Login Shell Assigned to Service Account games on Linux
Suspicious SSH Daemon Configuration Change Enabling Root Login
Suspicious Local Administrator Account Creation via Net Command via Process Creation (via process_creation)
Suspicious NTLM Network Logon From Attacker Controlled Workstation Names (via security)
Suspicious dMSA Object Access with Migration AccessMask
Suspicious Rogue Machine Account Creation via Powermad New-MachineAccount
Malicious Local Administrator Account Added via net localgroup (via process_creation)
Malicious ESX Admins Group Added to Privileged Directory Group
Malicious Switch User to Rogue Root-Equivalent Account troot (via process_creation)
Malicious Local Administrator Added by Atera RMM Agent
Pivot detection · T1078 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.