Action1 Remote Code Execution and Remote Sessions
Detects the execution of Action1, a Remote Monitoring and Management (RMM) tool, for arbitrary code execution or to establish remote sessions. The rule identifies these activities by looking for specific command-line patterns associated with Action1 agent deployments, script execution (via cmd.exe or powershell.exe), and the initiation of remote sessions through 'agent1_remote.exe'. The description also provides hunting opportunities to refine detection by baselining policy names and identifying remote sessions during abnormal hours.
Sigma
