Windows: Detect Action1 agent deployment, command execution, and remote session startup

title: "Windows: Detect Action1 agent deployment, command execution, and remote session startup"
id: 21df8757-5de6-4710-bdb8-cc422d7a303f
status: test
description: This rule flags Windows process creation where the Action1 agent is used to deploy a package, run scripts/commands, and/or initiate a remote session. Attackers can abuse Action1 to execute arbitrary code on endpoints or establish remote management sessions by triggering Action1’s scheduled app/script mechanisms. The detection relies on process creation telemetry and command-line context, including the Action1 agent binary path, command interpreter launches, and remote session process presence.
references:
  - https://twitter.com/Kostastsale/status/1646256901506605063?s=20
  - https://www.action1.com/documentation/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_remote_access_tools_action1_code_exec_and_remote_sessions.yml
author: "@kostastsale, Huntrule Team"
date: 2023-04-13
tags:
  - attack.command-and-control
  - attack.t1219.002
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_app_deployment_exec:
    ParentImage|endswith: \action1_agent.exe
    Image|contains: \Windows\Action1\package_downloads\
  selection_command_exec:
    ParentImage|endswith:
      - \cmd.exe
      - \powershell.exe
    ParentCommandLine|contains:
      - \Action1\scripts\Run_Command_
      - \Action1\scripts\Run_PowerShell_
  selection_remote_session_init:
    Image|endswith: \agent1_remote.exe
  condition: 1 of selection_*
falsepositives:
  - If Action1 is among the approved software in your environment, you might find that this is a noisy query. See description for ideas on how to alter this query and start looking for suspicious activities.
level: medium
license: DRL-1.1
related:
  - id: aa3168fb-d594-4f93-a92d-7a9ba675b766
    type: derived