Atera Agent Installation Detected

SigmaHQ Detections@sigmaHQ

•updated Jun 13, 2025•0•29

This rule detects the successful installation of the Atera Remote Monitoring & Management (RMM) agent by looking for specific Event ID 1033 from the MsiInstaller provider, where the message content includes 'AteraAgent'. This activity has been associated with threat actors, specifically Conti operators, using the Atera agent for command and control.