Techniques
Sample rules
Atera Agent Installation
- source: sigma
- technicques:
- t1219
Description
Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently found to be used by Conti operators
Detection logic
condition: selection
selection:
EventID: 1033
Message|contains: AteraAgent
Provider_Name: MsiInstaller