Arbitrary code execution and remote sessions via Action1 RMM

 1title: Arbitrary code execution and remote sessions via Action1 RMM
 2id: aa3168fb-d594-4f93-a92d-7a9ba675b766
 3hypothesis: Threat actors using Action1 to execute arbitrary code or establish a remote session
 4description: >
 5    Action1 is a powerful Remote Monitoring and Management tool that enables users to execute commands, scripts, and binaries. Through the web interface of action1,  
 6    the administrator must create a new policy or an app to establish remote execution and then points that the agent is installed. 
 7
 8    Hunting Opportunity 1- Weed Out The Noise
 9    ---
10    When threat actors execute a script, a command, or a binary through these new policies and apps, the names of these become visible in the command line during the execution process. 
11    Below is an example of the command line that contains the deployment of a binary through  a policy with name "test_app_1":
12
13    ParentCommandLine: "C:\WINDOWS\Action1\action1_agent.exe schedule:Deploy_App__test_app_1_1681327673425 runaction:0"
14
15    
16    After establishing a baseline, we can split the command to extract the policy name and group all the policy names and inspect the results with a list of frequency occurrences. 
17    An example query of this in Splunk could be: 
18
19    Index="<myindex>" source="<mysource>" Image="*\action1_agent.exe" ParentCommandLine="*runaction:0" | rex field=ParentCommandLine "(?<=Deploy_App__)(?<AppName>.*(?=(\_1)))"
20
21    
22    Hunting Opportunity 2 - Remote Sessions On Out Of Office Hours
23    ----
24    If you have admins within your environment using remote sessions to administer
25    endpoints, you can create a threat-hunting query and modify the time of the
26    initiated sessions looking for abnormal activity.     
27status: experimental
28date: 2023/04/13
29author: '@kostastsale'
30references:
31  - https://twitter.com/Kostastsale/status/1646256901506605063?s=20
32  - https://www.action1.com/documentation/
33logsource:
34    category: process_creation
35    product: windows
36detection:
37    AppDeploymentExec:
38      Image|contains:
39        - '\Windows\Action1\package_downloads\'
40      ParentImage|endswith:
41        - '\action1_agent.exe'
42    CommandExec:
43      ParentImage|endswith:
44        - '\cmd.exe'
45        - '\powershell.exe'
46      ParentCommandLine|contains:
47        - '\Action1\scripts\Run_Command_'
48        - '\Action1\scripts\Run_PowerShell_'
49    RemoteSessionInit:
50      Image|endswith:
51        - '\agent1_remote.exe'
52    condition: AppDeploymentExec or CommandExec or RemoteSessionInit
53falsepositives:
54    - "If Action1 is among the approved software in your environment, you might find that this is a noisy query. 
55      See description for ideas on how to alter this query and start looking for suspicious activities."
56level: medium
57tags:
58    - attack.CommandAndControl
59    - attack.T1219