AteraAgent Installation - Windows (Windows Event Log)

id: '29796.53836'
title: AteraAgent Installation - Windows
description: An adversary may use legitimate desktop support and remote access software
  to establish an interactive command and control channel to target systems within
  networks. These remote monitoring and management (RMM) tools, such as AteraAgent,
  are commonly used as legitimate technical support software and may be allowed by
  application control within a target environment. Remote access software may be installed
  and used post-compromise as an alternate communications channel for redundant access
  or as a way to establish an interactive remote desktop session with the target system.
  They may also be used as a component of malware to establish a reverse connection
  or back-connect to a service or adversary controlled system. This use case detects
  the installation of AteraAgent RMM.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` ((EventCode=1033) OR ">1033</EventID>")
  "MsiInstaller" "AteraAgent" | table _time, host, user, process_* | bin span=1s |
  stats values(*) as * by _time, host '
techniques:
- command-and-control:remote access software
technique_id: 
- T1219
data_category:
- Windows event logs
references:
- https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/
- https://www.cybereason.com/blog/threat-analysis-from-icedid-to-domain-compromise
- https://github.com/SigmaHQ/sigma/blob/04f72b9e78f196544f8f1331b4d9158df34d7ecf/rules/windows/builtin/application/win_software_atera_rmm_agent_install.yml
- https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign?utm_source=twitter&utm_medium=social_organic&utm_campaign=2024&utm_post_id=3c4043a3-313b-4b88-aca6-d74b47e16082
- https://www.atera.com/