Remote Access Tool - Action1 Arbitrary Code Execution and Remote Sessions

SIGMA detection rule by @kostastsale · GPL-2.0

Detects the execution of Action1 in order to execute arbitrary code or establish a remote session. Action1 is a powerful Remote Monitoring and Management tool that enables users to execute commands, scripts, and binaries. Through the web interface of action1, the administrator must create a new policy or an app to establish remote execution and then points that the agent is installed. Hunting Opportunity 1- Weed Out The Noise When threat actors execute a script, a command, or a binary through these new policies and apps, the names of these become visible in the command line during the execution process. Below is an example of the command line that contains the deployment of a binary through a policy with name "test_app_1": ParentCommandLine: "C:\WINDOWS\Action1\action1_agent.exe schedule:Deploy_App__test_app_1_1681327673425 runaction:0" After establishing a baseline, we can split the command to extract the policy name and group all the policy names and inspect the results with a list of frequency occurrences. Hunting Opportunity 2 - Remote Sessions On Out Of Office Hours If you have admins within your environment using remote sessions to administer endpoints, you can create a threat-hunting query and modify the time of the initiated sessions looking for abnormal activity.

title: Remote Access Tool - Action1 Arbitrary Code Execution and Remote Sessions
id: 441ef2d8-5da0-7432-b390-b778f9f5c77b
related:
    - id: aa3168fb-d594-4f93-a92d-7a9ba675b766
      type: derived
status: test
description: |
    Detects the execution of Action1 in order to execute arbitrary code or establish a remote session.

    Action1 is a powerful Remote Monitoring and Management tool that enables users to execute commands, scripts, and binaries.
    Through the web interface of action1, the administrator must create a new policy or an app to establish remote execution and then points that the agent is installed.

    Hunting Opportunity 1- Weed Out The Noise

    When threat actors execute a script, a command, or a binary through these new policies and apps, the names of these become visible in the command line during the execution process. Below is an example of the command line that contains the deployment of a binary through  a policy with name "test_app_1":

    ParentCommandLine: "C:\WINDOWS\Action1\action1_agent.exe schedule:Deploy_App__test_app_1_1681327673425 runaction:0"

    After establishing a baseline, we can split the command to extract the policy name and group all the policy names and inspect the results with a list of frequency occurrences.

    Hunting Opportunity 2 - Remote Sessions On Out Of Office Hours

    If you have admins within your environment using remote sessions to administer endpoints, you can create a threat-hunting query and modify the time of the initiated sessions looking for abnormal activity.
references:
    - https://twitter.com/Kostastsale/status/1646256901506605063?s=20
    - https://www.action1.com/documentation/
author: '@kostastsale'
date: 2023-04-13
tags:
    - attack.command-and-control
    - attack.t1219.002
    - detection.threat-hunting
logsource:
    category: process_creation
    product: windows
detection:
    process_creation:
        EventID: 4688
        Channel: Security
    selection_app_deployment_exec:
        ParentProcessName|endswith: \action1_agent.exe
        NewProcessName|contains: \Windows\Action1\package_downloads\
    selection_command_exec:
        ParentCommandLine|contains:
            - \Action1\scripts\Run_Command_
            - \Action1\scripts\Run_PowerShell_
        ParentProcessName|endswith:
            - \cmd.exe
            - \powershell.exe
    selection_remote_session_init:
        NewProcessName|endswith: \agent1_remote.exe
    condition: process_creation and (1 of selection_*)
falsepositives:
    - If Action1 is among the approved software in your environment, you might find that this is a noisy query. See description for ideas on how to alter this query and start looking for suspicious activities.
level: medium
ruletype: Sigma

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

60833a98-c81e-4e3d-966c-cca7e37f8a26

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion