Windows Service Control Manager: PDQDeployRunner Service Installation (PDQDeploy)

title: "Windows Service Control Manager: PDQDeployRunner Service Installation (PDQDeploy)"
id: 638b26d5-5d04-4362-8248-824da307f210
status: test
description: This rule identifies installation of a new Windows service via the Service Control Manager where the service name starts with "PDQDeployRunner-" and the configured image path contains "PDQDeployRunner-". Such services are created when PDQDeploy deploys a package and uses a remotely installed runner to execute actions on the target host. The detection relies on Windows System log event 7045 telemetry capturing the new service name and image path.
references:
  - https://documentation.pdq.com/PDQDeploy/13.0.3.0/index.html?windows-services.htm
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_pdqdeploy_runner.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-22
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.003
logsource:
  product: windows
  service: system
detection:
  selection_root:
    Provider_Name: Service Control Manager
    EventID: 7045
  selection_service:
    - ImagePath|contains: PDQDeployRunner-
    - ServiceName|startswith: PDQDeployRunner-
  condition: all of selection_*
falsepositives:
  - Legitimate use of the tool
level: medium
license: DRL-1.1
related:
  - id: b98a10af-1e1e-44a7-bab2-4cc026917648
    type: derived