MuddyWater SimpleHelp or AteraAgent RAT Install via Suspicious Parent

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•1

This rule detects the execution of RMM (Remote Monitoring and Management) installers (Atera or SimpleHelp) via msiexec.exe or setup.exe when launched from directories commonly used for downloads (Temp/Downloads) and originating from web browsers or Microsoft Office applications. This behavior is indicative of a potential drive-by download or phishing attack aimed at installing unauthorized remote access software.