Windows Atera RMM Agent Installation via MsiInstaller Event ID 1033
Flags Windows MSI installs where installer logs indicate an AteraAgent installation (EventID 1033, MsiInstaller).
- Product
- windows
- Service
- application
- Author
- Bhabesh Raj (SigmaHQ), DRL 1.1
- Published
- 2021-09-01
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies successful installation of an Atera Remote Monitoring & Management agent on Windows by matching an MsiInstaller Event ID 1033 where the message contains "AteraAgent." Attackers and administrators alike may install RMM agents to establish or extend remote access, making new agent installations an important signal for investigation. The detection relies on Windows application telemetry from MsiInstaller event logging and the presence of the AteraAgent string in the event message.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Atera RMM Agent Installation via MsiInstaller Event ID 1033
id: 7d966b7b-6257-41c9-ae14-86ce141bbd6b
status: test
description: This rule identifies successful installation of an Atera Remote Monitoring & Management agent on Windows by matching an MsiInstaller Event ID 1033 where the message contains "AteraAgent." Attackers and administrators alike may install RMM agents to establish or extend remote access, making new agent installations an important signal for investigation. The detection relies on Windows application telemetry from MsiInstaller event logging and the presence of the AteraAgent string in the event message.
references:
- https://www.advintel.io/post/secret-backdoor-behind-conti-ransomware-operation-introducing-atera-agent
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/msiinstaller/win_software_atera_rmm_agent_install.yml
author: Bhabesh Raj, Huntrule Team
date: 2021-09-01
modified: 2022-12-25
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
service: application
product: windows
detection:
selection:
EventID: 1033
Provider_Name: MsiInstaller
Message|contains: AteraAgent
condition: selection
falsepositives:
- Legitimate Atera agent installation
level: high
license: DRL-1.1
related:
- id: 87261fb2-69d0-42fe-b9de-88c6b5f65a43
type: derived