Remote Access Tool - Action1 Arbitrary Code Execution and Remote Sessions
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects the execution of Action1 in order to execute arbitrary code or establish a remote session. Action1 is a powerful Remote Monitoring and Management tool that enables users to execute commands, scripts, and binaries. Through the web interface of action1, the administrator must create a new policy or an app to establish remote execution and then points that the agent is installed. Hunting Opportunity 1- Weed Out The Noise When threat actors execute a script, a command, or a binary through these new policies and apps, the names of these become visible in the command line during the execution process. Below is an example of the command line that contains the deployment of a binary through a policy with name "test_app_1": ParentCommandLine: "C:\\WINDOWS\\Action1\\action1_agent.exe schedule:Deploy_App__test_app_1_1681327673425 runaction:0" After establishing a baseline, we can split the command to extract the policy name and group all the policy names and inspect the results with a list of frequency occurrences. Hunting Opportunity 2 - Remote Sessions On Out Of Office Hours If you have admins within your environment using remote sessions to administer endpoints, you can create a threat-hunting query and modify the time of the initiated sessions looking for abnormal activity.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Process started" AND (PARENTPROCESSNAME endswith "\action1_agent.exe" AND PROCESSNAME contains "\Windows\Action1\package_downloads") OR (PARENTPROCESSNAME endswith "\cmd.exe,\powershell.exe" AND PARENTPROCESSCOMMANDLINE contains "\Action1\scripts\Run_Command_,\Action1\scripts\Run_PowerShell_") OR PROCESSNAME endswith "\agent1_remote.exe" select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
@kostastsale
