Windows PDQ Deploy Console Execution

ATT&CK techniques

Execution → Lateral Movement

Recon
Resource Dev
Initial Access
Execution
- T1072Software Deployment Tools
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
- T1072Software Deployment Tools
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where PDQ Deploy Console (PDQDeployConsole.exe) is launched on Windows. Attackers can use remote administration tools to support lateral movement and execution across managed endpoints. The detection relies on process creation telemetry containing product/company metadata and the OriginalFileName field values associated with PDQ Deploy.

Reporting behind it

Related detections3 linkedT1072 — drag to rearrange

Windows SRP restricted application access (Event IDs 865, 866, 867, 868, 882)

Radmin Viewer Utility Execution on Windows (Process Creation)

Windows Process Creation: Suspicious Microsoft Csi.exe or Rcsi.exe with C# Execution Capability

Windows PDQ Deploy Console Execution

Pivot detection · T1072 · 3 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-pdq-deploy-console-execution-d679950c

title: Windows PDQ Deploy Console Execution
id: 21387d51-4273-47a8-b1f8-4ad195ed0f9a
related:
  - id: 12b8e9f5-96b2-41e1-9a42-8c6779a5c184
    type: similar
  - id: d679950c-abb7-43a6-80fb-2a480c4fc450
    type: derived
status: test
description: This rule flags process creation events where PDQ Deploy Console (PDQDeployConsole.exe) is launched on Windows. Attackers can use remote administration tools to support lateral movement and execution across managed endpoints. The detection relies on process creation telemetry containing product/company metadata and the OriginalFileName field values associated with PDQ Deploy.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1072/T1072.md
  - https://www.pdq.com/pdq-deploy/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pdqdeploy_execution.yml
author: frack113, Huntrule Team
date: 2022-10-01
modified: 2023-01-30
tags:
  - attack.execution
  - attack.lateral-movement
  - attack.t1072
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Description: PDQ Deploy Console
    - Product: PDQ Deploy
    - Company: PDQ.com
    - OriginalFileName: PDQDeployConsole.exe
  condition: selection
falsepositives:
  - Legitimate use
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL