Action1
Named by 3 kept items in this workspace.
2 items name it under affected products and 1 under tools.
Search every workspace for Action1. It matches the name as written, so it can find other things that share it.
The items that name it 3
Legitimate vulnerability management tool; in the cited example, attackers used it to deploy ScreenConnect for persistent remote access
Added to v2 RMM scan list.
Vulnerability management software abused to deploy ScreenConnect clients via Microsoft Installer packages.
All technologies in this workspace.