PDQ Deploy Remote Adminstartion Tool Execution

Title: PDQ Deploy Remote Adminstartion Tool Execution
Status: test
Description:Detect use of PDQ Deploy remote admin tool
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1072/T1072.md
  -https://www.pdq.com/pdq-deploy/
Author: frack113
Date: 2022-10-01
modified:2023-01-30
Tags:

• -'attack.execution'
• -'attack.lateral-movement'
• -'attack.t1072'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
Description:'PDQ Deploy Console' Product:'PDQ Deploy' Company:'PDQ.com' OriginalFileName:'PDQDeployConsole.exe'   condition:selection
Falsepositives:
  -Legitimate use
Level: medium