New PDQDeploy Service - Server Side

Status: test
Severity: medium
Log source: product windows, service system
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects a PDQDeploy service installation which indicates that PDQDeploy was installed on the machines. PDQDeploy can be abused by attackers to remotely install packages or execute commands on target machines

Known false positives

Legitimate use of the tool

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1543.003` Create or Modify System Process: Windows Service
Privilege Escalation	`T1543.003` Create or Modify System Process: Windows Service

Telemetry coverage

Provider	Record / event type
Service-Control-Manager	Event ID 7045: A service was installed in the system.

Rule body

title: New PDQDeploy Service - Server Side
id: ee9ca27c-9bd7-4cee-9b01-6e906be7cae3
status: test
description: |
    Detects a PDQDeploy service installation which indicates that PDQDeploy was installed on the machines.
    PDQDeploy can be abused by attackers to remotely install packages or execute commands on target machines
references:
    - https://documentation.pdq.com/PDQDeploy/13.0.3.0/index.html?windows-services.htm
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-22
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1543.003
logsource:
    product: windows
    service: system
detection:
    selection_root:
        Provider_Name: 'Service Control Manager'
        EventID: 7045
    selection_service:
        - ImagePath|contains: 'PDQDeployService.exe'
        - ServiceName:
              - 'PDQDeploy'
              - 'PDQ Deploy'
    condition: all of selection_*
falsepositives:
    - Legitimate use of the tool
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_root`

selection_root:
    Provider_Name: 'Service Control Manager'
    EventID: 7045

Stage 2: `selection_service`

selection_service:
    - ImagePath|contains: 'PDQDeployService.exe'
    - ServiceName:
          - 'PDQDeploy'
          - 'PDQ Deploy'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ImagePath`	match	`PDQDeployService.exe`	`field:"ImagePath" kind:match value:"PDQDeployService.exe"`
`Provider_Name`	eq	`Service Control Manager` corpus 50 (sigma 50)	`field:"Provider_Name" kind:eq value:"Service Control Manager"`
`ServiceName`	eq	`PDQ Deploy` `PDQDeploy`	`field:"ServiceName" kind:eq`