Detection rules › Splunk
AteraAgent Installation - Windows (Sysmon)
An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These remote monitoring and management (RMM) tools, such as AteraAgent, are commonly used as legitimate technical support software and may be allowed by application control within a target environment. Remote access software may be installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote desktop session with the target system. They may also be used as a component of malware to establish a reverse connection or back-connect to a service or adversary controlled system. This use case detects the installation of AteraAgent RMM.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Command & Control | T1219 Remote Access Tools |
References
- https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/
- https://www.cybereason.com/blog/threat-analysis-from-icedid-to-domain-compromise
- https://github.com/SigmaHQ/sigma/blob/04f72b9e78f196544f8f1331b4d9158df34d7ecf/rules/windows/builtin/application/win_software_atera_rmm_agent_install.yml
- https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign?utm_source=twitter&utm_medium=social_organic&utm_campaign=2024&utm_post_id=3c4043a3-313b-4b88-aca6-d74b47e16082
- https://www.atera.com/
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 22 | DNSEvent (DNS query) |
Rule body yaml
id: '29796.53837'
title: AteraAgent Installation - Windows
description: An adversary may use legitimate desktop support and remote access software
to establish an interactive command and control channel to target systems within
networks. These remote monitoring and management (RMM) tools, such as AteraAgent,
are commonly used as legitimate technical support software and may be allowed by
application control within a target environment. Remote access software may be installed
and used post-compromise as an alternate communications channel for redundant access
or as a way to establish an interactive remote desktop session with the target system.
They may also be used as a component of malware to establish a reverse connection
or back-connect to a service or adversary controlled system. This use case detects
the installation of AteraAgent RMM.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=22) OR "<EventID>22<")
TERM(atera) (TERM(rundll32) OR "rundll32.exe") | table _time, host, user, signature_ID,
QueryName, process_name | bin span=1s | stats values(*) as * by _time, host '
techniques:
- command-and-control:remote access software
technique_id:
- T1219
data_category:
- Windows Sysmon
references:
- https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/
- https://www.cybereason.com/blog/threat-analysis-from-icedid-to-domain-compromise
- https://github.com/SigmaHQ/sigma/blob/04f72b9e78f196544f8f1331b4d9158df34d7ecf/rules/windows/builtin/application/win_software_atera_rmm_agent_install.yml
- https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign?utm_source=twitter&utm_medium=social_organic&utm_campaign=2024&utm_post_id=3c4043a3-313b-4b88-aca6-d74b47e16082
- https://www.atera.com/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=22) OR "<EventID>22<") TERM(atera) (TERM(rundll32) OR "rundll32.exe")
Stage 2: table
| table _time, host, user, signature_ID, QueryName, process_name
Stage 3: bucket
| bin span=1s
Stage 4: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>22<" |
| 1 | TERM |
| 1 | atera |
| 1 | TERM |
| 1 | rundll32 |
| 1 | "rundll32.exe" |