Windows: Detect Action1 agent deployment, command execution, and remote session startup
Finds Action1 agent deployments, script-launched command/PowerShell execution, and remote session starts on Windows.
- Product
- windows
- Category
- process_creation
- Author
- @kostastsale (SigmaHQ), DRL 1.1
- Published
- 2023-04-13
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Windows process creation where the Action1 agent is used to deploy a package, run scripts/commands, and/or initiate a remote session. Attackers can abuse Action1 to execute arbitrary code on endpoints or establish remote management sessions by triggering Action1’s scheduled app/script mechanisms. The detection relies on process creation telemetry and command-line context, including the Action1 agent binary path, command interpreter launches, and remote session process presence.
Reporting behind it
- twitter.comhttps://twitter.com/Kostastsale/status/1646256901506605063?s=20
- action1.comhttps://www.action1.com/documentation/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_remote_access_tools_action1_code_exec_and_remote_sessions.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Detect Action1 agent deployment, command execution, and remote session startup"
id: 21df8757-5de6-4710-bdb8-cc422d7a303f
status: test
description: This rule flags Windows process creation where the Action1 agent is used to deploy a package, run scripts/commands, and/or initiate a remote session. Attackers can abuse Action1 to execute arbitrary code on endpoints or establish remote management sessions by triggering Action1’s scheduled app/script mechanisms. The detection relies on process creation telemetry and command-line context, including the Action1 agent binary path, command interpreter launches, and remote session process presence.
references:
- https://twitter.com/Kostastsale/status/1646256901506605063?s=20
- https://www.action1.com/documentation/
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_remote_access_tools_action1_code_exec_and_remote_sessions.yml
author: "@kostastsale, Huntrule Team"
date: 2023-04-13
tags:
- attack.command-and-control
- attack.t1219.002
- detection.threat-hunting
logsource:
category: process_creation
product: windows
detection:
selection_app_deployment_exec:
ParentImage|endswith: \action1_agent.exe
Image|contains: \Windows\Action1\package_downloads\
selection_command_exec:
ParentImage|endswith:
- \cmd.exe
- \powershell.exe
ParentCommandLine|contains:
- \Action1\scripts\Run_Command_
- \Action1\scripts\Run_PowerShell_
selection_remote_session_init:
Image|endswith: \agent1_remote.exe
condition: 1 of selection_*
falsepositives:
- If Action1 is among the approved software in your environment, you might find that this is a noisy query. See description for ideas on how to alter this query and start looking for suspicious activities.
level: medium
license: DRL-1.1
related:
- id: aa3168fb-d594-4f93-a92d-7a9ba675b766
type: derived