CVE-2024-4746: Automation Anywhere Control Room Exploit Chain — Detection and Hardening

---
title: Automation Anywhere Control Room Process Anomaly
id: 8a4b2c19-7d3e-4f1a-9b0c-3d5e6f7a8b9c
status: experimental
description: Detects the Automation Anywhere Java process spawning suspicious child processes (cmd, powershell), indicative of post-exploitation activity.
references:
  - https://www.darkreading.com/vulnerabilities-threats/complex-cloud-integrations-small-errors-compromises
author: Security Arsenal
date: 2025/03/20
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains:
      - '\Java\'
      - '\jre\'
    ParentImage|contains:
      - 'Automation Anywhere'
      - 'AA-'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Legitimate administrative scripts running via the automation engine (rare)
level: high
---
title: Automation Anywhere Credential Vault File Access
id: 9b5c3d20-8e4f-5g2b-0c1d-4e6f7a8b9c0d
status: experimental
description: Detects access to the Automation Anywhere Credential Vault or sensitive configuration directories by processes other than the main service.
references:
  - https://www.darkreading.com/vulnerabilities-threats/complex-cloud-integrations-small-errors-compromises
author: Security Arsenal
date: 2025/03/20
tags:
  - attack.credential_access
  - attack.t1003
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\Automation Anywhere\Automation 360\config\'
      - '\Automation Anywhere\Automation Anywhere\My Documents\'
      - '\Automation 360\repository\'
  filter:
    Image|contains:
      - 'AAServer.exe'
      - 'AAWebService.exe'
      - 'Java'
  condition: selection and not filter
falsepositives:
  - Backup software scanning the directory
  - Authorized administrator inspection
level: medium
---
title: Cloud Metadata Access from Automation Host
id: 0c6d4e31-9f5g-6h3c-1d2e-5f7a8b9c0d1e
status: experimental
description: Detects the Automation Anywhere server or service account accessing cloud metadata services (IMDS), a common move after stealing bot credentials.
references:
  - https://www.darkreading.com/vulnerabilities-threats/complex-cloud-integrations-small-errors-compromises
author: Security Arsenal
date: 2025/03/20
tags:
  - attack.defense_evasion
  - attack.t1552.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationIp:
      - '169.254.169.254'
    Image|contains:
      - 'curl'
      - 'wget'
      - 'java'
      - 'powershell'
  filter:
    User|contains:
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not filter
falsepositives:
  - Legitimate cloud-based automation tasks retrieving instance metadata
level: high

// Hunt for suspicious process spawning by Automation Anywhere Java Service
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ParentProcessName has @"Automation Anywhere" and ParentProcessName endswith ".exe"
| where ProcessName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "bash.exe", "wscript.exe", "cscript.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, ParentProcessName, InitiatingProcessFileName
| order by Timestamp desc

// Hunt for access to Credential Vault directories
DeviceFileEvents
| where Timestamp > ago(7d)
| whereFolderPath contains @"Automation Anywhere" 
| where FolderPath contains @"config" or FolderPath contains @"repository"
| where ActionType == "FileAccessed" or ActionType == "FileRead"
| where InitiatingProcessFileName !in~ ("AAServer.exe", "AAWebService.exe", "java.exe")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FolderPath, FileName, ActionType
| order by Timestamp desc

-- Hunt for Automation Anywhere Service binaries and check for suspicious child processes
SELECT Pid, Name, CommandLine, Exe, Username, Parent.Pid AS ParentPid
FROM pslist()
WHERE Name =~ "AAServer" OR Name =~ "AAWebService"

-- Hunt for Credential Vault configuration files accessed recently
SELECT FullPath, Mtime, Atime, Size, Mode
FROM glob(globs="**/Automation Anywhere/**/config/*.config")
WHERE Atime < now() - 3600  -- Accessed in the last hour

# Check Automation Anywhere Version for Vulnerability
# Usage: Run as Administrator on the Control Room server

$RegPath = "HKLM:\SOFTWARE\Wow6432Node\Automation Anywhere\Automation 360"
$InstallPath = (Get-ItemProperty -Path $RegPath -ErrorAction SilentlyContinue).InstallLocation

if ($InstallPath) {
    Write-Host "[+] Installation Path Found: $InstallPath"
    
    # Check specific DLL or Exe version for patch validation (Placeholder logic)
    $TargetFile = "$InstallPath\AAServer.exe"
    if (Test-Path $TargetFile) {
        $FileVersion = (Get-Item $TargetFile).VersionInfo.FileVersion
        Write-Host "[+] Current Version: $FileVersion"
        
        # Note: Replace with specific patch version from vendor advisory
        $SafeVersion = "13.0.0.0" 
        if ($FileVersion -lt $SafeVersion) {
            Write-Host "[!] ALERT: Version is vulnerable. Please apply the latest hotfix from Automation Anywhere support." -ForegroundColor Red
        } else {
            Write-Host "[*] Version appears patched." -ForegroundColor Green
        }
    }
} else {
    Write-Host "[-] Automation Anywhere registry path not found." -ForegroundColor Yellow
}

# Audit ACLs on Credential Vault Directory
$VaultPath = "$InstallPath\config"
if (Test-Path $VaultPath) {
    Write-Host "[+] Auditing permissions on: $VaultPath"
    Get-Acl -Path $VaultPath | Format-List Owner, AccessToString
} else {
    Write-Host "[-] Vault path not found."
}