Windows Process Execution of Action1 Agent and Remote Session Setup

title: Windows Process Execution of Action1 Agent and Remote Session Setup
id: 21df8757-5de6-4710-bdb8-cc422d7a303f
status: test
description: This rule identifies Windows process activity associated with Action1 agent deployments, including execution paths under the Action1 package_downloads directory. It also matches command or PowerShell launcher usage where the parent command line contains Action1 script execution markers, indicating remote command execution. Finally, it flags remote session initialization when the agent1_remote.exe process is started. The detection relies on process creation telemetry with fields for Image, ParentImage, ParentCommandLine, and process paths.
references:
  - https://twitter.com/Kostastsale/status/1646256901506605063?s=20
  - https://www.action1.com/documentation/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_remote_access_tools_action1_code_exec_and_remote_sessions.yml
author: "@kostastsale, Huntrule Team"
date: 2023-04-13
tags:
  - attack.command-and-control
  - attack.t1219.002
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_app_deployment_exec:
    ParentImage|endswith: \action1_agent.exe
    Image|contains: \Windows\Action1\package_downloads\
  selection_command_exec:
    ParentImage|endswith:
      - \cmd.exe
      - \powershell.exe
    ParentCommandLine|contains:
      - \Action1\scripts\Run_Command_
      - \Action1\scripts\Run_PowerShell_
  selection_remote_session_init:
    Image|endswith: \agent1_remote.exe
  condition: 1 of selection_*
falsepositives:
  - If Action1 is among the approved software in your environment, you might find that this is a noisy query. See description for ideas on how to alter this query and start looking for suspicious activities.
level: medium
license: DRL-1.1
related:
  - id: aa3168fb-d594-4f93-a92d-7a9ba675b766
    type: derived