Detectionmediumtest
New PDQDeploy Service - Client Side
Detects PDQDeploy service installation on the target system. When a package is deployed via PDQDeploy it installs a remote service on the target machine with the name "PDQDeployRunner-X" where "X" is an integer starting from 1
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Nasreddine Bencherchali (Nextron Systems)Created Fri Jul 22b98a10af-1e1e-44a7-bab2-4cc026917648windows
Log Source
Windowssystem
ProductWindows← raw: windows
Servicesystem← raw: system
Detection Logic
Detection Logic2 selectors
detection:
selection_root:
Provider_Name: 'Service Control Manager'
EventID: 7045
selection_service:
- ImagePath|contains: 'PDQDeployRunner-'
- ServiceName|startswith: 'PDQDeployRunner-'
condition: all of selection_*False Positives
Legitimate use of the tool
References
MITRE ATT&CK
Sub-techniques
Rule Metadata
Rule ID
b98a10af-1e1e-44a7-bab2-4cc026917648
Status
test
Level
medium
Type
Detection
Created
Fri Jul 22
Path
rules/windows/builtin/system/service_control_manager/win_system_service_install_pdqdeploy_runner.yml
Raw Tags
attack.persistenceattack.privilege-escalationattack.t1543.003