Sagan critical stable other
[WINDOWS-SECURITY] Atera Registry Key Deleted
[WINDOWS-SECURITY] Atera Registry Key Deleted
Detection Logic
alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SECURITY] Atera Registry Key Deleted"; program:*Security*; event_id:4688,1; content:"REG DELETE"; content:"ATERA Networks"; reference:url,https://thedfirreport.com/2024/08/12/threat-actors-toolkit-leveraging-sliver-poshc2-batch-scripts/; reference:url,https://community.atera.com/discussion/240/atera-agent-found-malicious-by-bitdefender/p2; classtype:trojan-activity; sid:5015075; rev:1; metadata:deployment Endpoint, created_at 2024_08_13, updated_at 2024_08_13, mitre_tactic_id TA0030, mitre_technique_id T1630;) Field Validations
Loading…
Comments (0)
Loading comments...