New PDQDeploy Service - Client Side

 1title: New PDQDeploy Service - Client Side
 2id: b98a10af-1e1e-44a7-bab2-4cc026917648
 3status: test
 4description: |
 5    Detects PDQDeploy service installation on the target system.
 6    When a package is deployed via PDQDeploy it installs a remote service on the target machine with the name "PDQDeployRunner-X" where "X" is an integer starting from 1    
 7references:
 8    - https://documentation.pdq.com/PDQDeploy/13.0.3.0/index.html?windows-services.htm
 9author: Nasreddine Bencherchali (Nextron Systems)
10date: 2022-07-22
11tags:
12    - attack.persistence
13    - attack.privilege-escalation
14    - attack.t1543.003
15logsource:
16    product: windows
17    service: system
18detection:
19    selection_root:
20        Provider_Name: 'Service Control Manager'
21        EventID: 7045
22    selection_service:
23        - ImagePath|contains: 'PDQDeployRunner-'
24        - ServiceName|startswith: 'PDQDeployRunner-'
25    condition: all of selection_*
26falsepositives:
27    - Legitimate use of the tool
28level: medium