Title:New PDQDeploy Service - Client Side Status:test Description:Detects PDQDeploy service installation on the target system.
When a package is deployed via PDQDeploy it installs a remote service on the target machine with the name "PDQDeployRunner-X" where "X" is an integer starting from 1
References: -https://documentation.pdq.com/PDQDeploy/13.0.3.0/index.html?windows-services.htm Author: Nasreddine Bencherchali (Nextron Systems) Date: 2022-07-22 modified:None Tags:
-'attack.persistence'
-'attack.privilege-escalation'
-'attack.t1543.003'
Logsource:
product: windows
service: system
Detection: selection_root: Provider_Name:
'Service Control Manager' EventID:
'7045' selection_service: ImagePath|contains:'PDQDeployRunner-'ServiceName|startswith:'PDQDeployRunner-'condition:all of selection_* Falsepositives:
-Legitimate use of the tool Level:medium
