LoFP LoFP / legitimate use of the tool

Techniques

Sample rules

New PDQDeploy Service - Server Side

Description

Detects a PDQDeploy service installation which indicates that PDQDeploy was installed on the machines. PDQDeploy can be abused by attackers to remotely install packages or execute commands on target machines

Detection logic

condition: all of selection_*
selection_root:
  EventID: 7045
  Provider_Name: Service Control Manager
selection_service:
- ImagePath|contains: PDQDeployService.exe
- ServiceName:
  - PDQDeploy
  - PDQ Deploy

NetSupport Manager Service Install

Description

Detects NetSupport Manager service installation on the target system.

Detection logic

condition: all of selection_*
selection_root:
  EventID: 7045
  Provider_Name: Service Control Manager
selection_service:
- ImagePath|contains: \NetSupport Manager\client32.exe
- ServiceName: Client32

New PDQDeploy Service - Client Side

Description

Detects PDQDeploy service installation on the target system. When a package is deployed via PDQDeploy it installs a remote service on the target machine with the name “PDQDeployRunner-X” where “X” is an integer starting from 1

Detection logic

condition: all of selection_*
selection_root:
  EventID: 7045
  Provider_Name: Service Control Manager
selection_service:
- ImagePath|contains: PDQDeployRunner-
- ServiceName|startswith: PDQDeployRunner-

Remote Utilities Host Service Install

Description

Detects Remote Utilities Host service installation on the target system.

Detection logic

condition: all of selection_*
selection_root:
  EventID: 7045
  Provider_Name: Service Control Manager
selection_service:
- ImagePath|contains|all:
  - \rutserv.exe
  - -service
- ServiceName: Remote Utilities - Host

Mesh Agent Service Installation

Description

Detects a Mesh Agent service installation. Mesh Agent is used to remotely manage computers

Detection logic

condition: all of selection_*
selection_root:
  EventID: 7045
  Provider_Name: Service Control Manager
selection_service:
- ImagePath|contains: MeshAgent.exe
- ServiceName|contains: Mesh Agent

TacticalRMM Service Installation

Description

Detects a TacticalRMM service installation. Tactical RMM is a remote monitoring & management tool.

Detection logic

condition: all of selection_*
selection_root:
  EventID: 7045
  Provider_Name: Service Control Manager
selection_service:
- ImagePath|contains: tacticalrmm.exe
- ServiceName|contains: TacticalRMM Agent Service