Windows Service Installation of PDQDeploy Service (Service Control Manager Event 7045)

Flags new Windows services installed via SCM Event 7045 that reference PDQDeployService.exe.

FreeUnreviewedSigmamediumv1

windows-service-installation-of-pdqdeploy-service-service-control-manager-event--ee9ca27c

title: Windows Service Installation of PDQDeploy Service (Service Control Manager Event 7045)
id: cdf43ec4-d7f9-45d6-9c68-df96a557fbf0
status: test
description: This rule identifies creation of a new Windows service associated with PDQDeploy by matching Service Control Manager EventID 7045. Attackers can abuse PDQDeploy to persist and remotely deploy packages or execute commands across target machines. It relies on Windows service installation telemetry, specifically the service name and the ImagePath containing PDQDeployService.exe.
references:
  - https://documentation.pdq.com/PDQDeploy/13.0.3.0/index.html?windows-services.htm
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_pdqdeploy.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-22
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.003
logsource:
  product: windows
  service: system
detection:
  selection_root:
    Provider_Name: Service Control Manager
    EventID: 7045
  selection_service:
    - ImagePath|contains: PDQDeployService.exe
    - ServiceName:
        - PDQDeploy
        - PDQ Deploy
  condition: all of selection_*
falsepositives:
  - Legitimate use of the tool
level: medium
license: DRL-1.1
related:
  - id: ee9ca27c-9bd7-4cee-9b01-6e906be7cae3
    type: derived

What it detects

This rule identifies creation of a new Windows service associated with PDQDeploy by matching Service Control Manager EventID 7045. Attackers can abuse PDQDeploy to persist and remotely deploy packages or execute commands across target machines. It relies on Windows service installation telemetry, specifically the service name and the ImagePath containing PDQDeployService.exe.

Known false positives

Legitimate use of the tool

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.