Windows Successful Installation of Atera Remote Monitoring Agent via MSI

Flags Windows MSI installs where installer logs indicate an AteraAgent installation (EventID 1033, MsiInstaller).

FreeUnreviewedSigmahighv1

windows-successful-installation-of-atera-remote-monitoring-agent-via-msi-87261fb2

title: Windows Successful Installation of Atera Remote Monitoring Agent via MSI
id: 7d966b7b-6257-41c9-ae14-86ce141bbd6b
status: test
description: This rule identifies successful installation events for the Atera Remote Monitoring & Management agent on Windows by matching MSI installer telemetry. Attackers may deploy remote monitoring agents to establish command-and-control persistence and regain access to endpoints. It relies on application service logs showing an MSI installation message containing "AteraAgent" with EventID 1033 from the MsiInstaller provider.
references:
  - https://www.advintel.io/post/secret-backdoor-behind-conti-ransomware-operation-introducing-atera-agent
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/msiinstaller/win_software_atera_rmm_agent_install.yml
author: Bhabesh Raj, Huntrule Team
date: 2021-09-01
modified: 2022-12-25
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  service: application
  product: windows
detection:
  selection:
    EventID: 1033
    Provider_Name: MsiInstaller
    Message|contains: AteraAgent
  condition: selection
falsepositives:
  - Legitimate Atera agent installation
level: high
license: DRL-1.1
related:
  - id: 87261fb2-69d0-42fe-b9de-88c6b5f65a43
    type: derived

What it detects

This rule identifies successful installation events for the Atera Remote Monitoring & Management agent on Windows by matching MSI installer telemetry. Attackers may deploy remote monitoring agents to establish command-and-control persistence and regain access to endpoints. It relies on application service logs showing an MSI installation message containing "AteraAgent" with EventID 1033 from the MsiInstaller provider.

Known false positives

Legitimate Atera agent installation

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.