Sagan critical stable other

[WINDOWS-SECURITY] Atera Registry Key Deleted

[WINDOWS-SECURITY] Atera Registry Key Deleted

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SECURITY] Atera Registry Key Deleted"; program:*Security*; event_id:4688,1; content:"REG DELETE"; content:"ATERA Networks"; reference:url,https://thedfirreport.com/2024/08/12/threat-actors-toolkit-leveraging-sliver-poshc2-batch-scripts/; reference:url,https://community.atera.com/discussion/240/atera-agent-found-malicious-by-bitdefender/p2; classtype:trojan-activity; sid:5015075; rev:1; metadata:deployment Endpoint, created_at 2024_08_13, updated_at 2024_08_13, mitre_tactic_id TA0030, mitre_technique_id T1630;)

Field Validations

Loading…

Comments (0)

Loading comments...