Title:New PDQDeploy Service - Server Side Status:test Description:Detects a PDQDeploy service installation which indicates that PDQDeploy was installed on the machines.
PDQDeploy can be abused by attackers to remotely install packages or execute commands on target machines
References: -https://documentation.pdq.com/PDQDeploy/13.0.3.0/index.html?windows-services.htm Author: Nasreddine Bencherchali (Nextron Systems) Date: 2022-07-22 modified:None Tags:
-'attack.persistence'
-'attack.privilege-escalation'
-'attack.t1543.003'
Logsource:
product: windows
service: system
Detection: selection_root: Provider_Name:
'Service Control Manager' EventID:
'7045' selection_service: ImagePath|contains:'PDQDeployService.exe'- ServiceName: - 'PDQDeploy' - 'PDQ Deploy' condition:all of selection_* Falsepositives:
-Legitimate use of the tool Level:medium
