Windows PDQ Deploy Console Execution

title: Windows PDQ Deploy Console Execution
id: 21387d51-4273-47a8-b1f8-4ad195ed0f9a
related:
  - id: 12b8e9f5-96b2-41e1-9a42-8c6779a5c184
    type: similar
  - id: d679950c-abb7-43a6-80fb-2a480c4fc450
    type: derived
status: test
description: This rule flags process creation events where PDQ Deploy Console (PDQDeployConsole.exe) is launched on Windows. Attackers can use remote administration tools to support lateral movement and execution across managed endpoints. The detection relies on process creation telemetry containing product/company metadata and the OriginalFileName field values associated with PDQ Deploy.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1072/T1072.md
  - https://www.pdq.com/pdq-deploy/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pdqdeploy_execution.yml
author: frack113, Huntrule Team
date: 2022-10-01
modified: 2023-01-30
tags:
  - attack.execution
  - attack.lateral-movement
  - attack.t1072
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Description: PDQ Deploy Console
    - Product: PDQ Deploy
    - Company: PDQ.com
    - OriginalFileName: PDQDeployConsole.exe
  condition: selection
falsepositives:
  - Legitimate use
level: medium
license: DRL-1.1