huntrule

Windows Atera RMM Agent Installation via MsiInstaller Event ID 1033

Flags Windows MSI installs where installer logs indicate an AteraAgent installation (EventID 1033, MsiInstaller).

FreeReviewedSigma · High · v2
Product
windows
Service
application
Author
Bhabesh Raj (SigmaHQ), DRL 1.1
Published
2021-09-01
Updated
2026-07-31
AnalysisDetection
title: Windows Atera RMM Agent Installation via MsiInstaller Event ID 1033
id: 7d966b7b-6257-41c9-ae14-86ce141bbd6b
status: test
description: This rule identifies successful installation of an Atera Remote Monitoring & Management agent on Windows by matching an MsiInstaller Event ID 1033 where the message contains "AteraAgent." Attackers and administrators alike may install RMM agents to establish or extend remote access, making new agent installations an important signal for investigation. The detection relies on Windows application telemetry from MsiInstaller event logging and the presence of the AteraAgent string in the event message.
references:
  - https://www.advintel.io/post/secret-backdoor-behind-conti-ransomware-operation-introducing-atera-agent
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/msiinstaller/win_software_atera_rmm_agent_install.yml
author: Bhabesh Raj, Huntrule Team
date: 2021-09-01
modified: 2022-12-25
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  service: application
  product: windows
detection:
  selection:
    EventID: 1033
    Provider_Name: MsiInstaller
    Message|contains: AteraAgent
  condition: selection
falsepositives:
  - Legitimate Atera agent installation
level: high
license: DRL-1.1
related:
  - id: 87261fb2-69d0-42fe-b9de-88c6b5f65a43
    type: derived