New PDQDeploy Service - Client Side

 1title: New PDQDeploy Service - Client Side
 2id: b98a10af-1e1e-44a7-bab2-4cc026917648
 3status: test
 4description: |
 5    Detects PDQDeploy service installation on the target system.
 6    When a package is deployed via PDQDeploy it installs a remote service on the target machine with the name "PDQDeployRunner-X" where "X" is an integer starting from 1    
 7references:
 8    - https://documentation.pdq.com/PDQDeploy/13.0.3.0/index.html?windows-services.htm
 9author: Nasreddine Bencherchali (Nextron Systems)
10date: 2022/07/22
11tags:
12    - attack.privilege_escalation
13    - attack.t1543.003
14logsource:
15    product: windows
16    service: system
17detection:
18    selection_root:
19        Provider_Name: 'Service Control Manager'
20        EventID: 7045
21    selection_service:
22        - ImagePath|contains: 'PDQDeployRunner-'
23        - ServiceName|startswith: 'PDQDeployRunner-'
24    condition: all of selection_*
25falsepositives:
26    - Legitimate use of the tool
27level: medium