CmdID

CmdID / Files

action1_agent.exe

Action1 is a powerful Remote Monitoring and Management(RMM) tool that enables users to execute commands, scripts, and binaries. LOLRMM

Program on Windows LOLRMM Action1 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

A file of Action1

a remote management tool, from LOLRMM

LOLRMM lists a file named action1_agent.exe as Action1’s.

From LOLRMM (Apache 2.0), which lists the remote management tools intruders are known to use as well as administrators. It goes by the file’s name.

What detects it

Sigma process creation rules that name action1_agent.exe