Suspicious PDQDeployRunner Execution on Windows with Encoded/Download Indicators

Alerts on child process activity from PDQDeployRunner parents showing encoded, hidden, or download-related command line indicators.

FreeUnreviewedSigmamediumv1

suspicious-pdqdeployrunner-execution-on-windows-with-encoded-download-indicators-12b8e9f5

title: Suspicious PDQDeployRunner Execution on Windows with Encoded/Download Indicators
id: 384093d2-3a62-48e2-ae91-1ab0cf3b05f2
related:
  - id: d679950c-abb7-43a6-80fb-2a480c4fc450
    type: similar
  - id: 12b8e9f5-96b2-41e1-9a42-8c6779a5c184
    type: derived
status: test
description: This rule flags process creation where the parent process image contains the PDQDeployRunner naming pattern and the spawned child process matches specific suspicious execution indicators. It matters because PDQDeployRunner can be abused to execute remote commands, including PowerShell-style encoded or hidden download/decode behavior. The detection relies on Windows process creation telemetry, specifically the parent image, child image name/path, and child command line substrings such as -enc/-encodedcommand and web/download/decode functions.
references:
  - https://twitter.com/malmoeb/status/1550483085472432128
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pdqdeploy_runner_susp_children.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-22
modified: 2024-05-02
tags:
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains: \PDQDeployRunner-
  selection_child:
    - Image|endswith:
        - \bash.exe
        - \certutil.exe
        - \cmd.exe
        - \csc.exe
        - \cscript.exe
        - \dllhost.exe
        - \mshta.exe
        - \msiexec.exe
        - \regsvr32.exe
        - \rundll32.exe
        - \scriptrunner.exe
        - \wmic.exe
        - \wscript.exe
        - \wsl.exe
    - Image|contains:
        - :\ProgramData\
        - :\Users\Public\
        - :\Windows\TEMP\
        - \AppData\Local\Temp
    - CommandLine|contains:
        - " -decode "
        - " -enc "
        - " -encodedcommand "
        - " -w hidden"
        - DownloadString
        - FromBase64String
        - http
        - "iex "
        - Invoke-
  condition: all of selection_*
falsepositives:
  - Legitimate use of the PDQDeploy tool to execute these commands
level: medium
license: DRL-1.1

What it detects

This rule flags process creation where the parent process image contains the PDQDeployRunner naming pattern and the spawned child process matches specific suspicious execution indicators. It matters because PDQDeployRunner can be abused to execute remote commands, including PowerShell-style encoded or hidden download/decode behavior. The detection relies on Windows process creation telemetry, specifically the parent image, child image name/path, and child command line substrings such as -enc/-encodedcommand and web/download/decode functions.

Known false positives

Legitimate use of the PDQDeploy tool to execute these commands

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.