Suspicious Process Tree Execution Via PDQDeployRunner

Nasreddine Bencherchali (Nextron Systems)

Detects suspicious child processes executed via "PDQDeployRunner". PDQDeployRunner is part of the PDQDeploy service stack that is responsible for executing commands and packages on a remote machines. Threats such as Avos Locker were seen abusing RMM utilities in order to execute command remotely.

2024-05-02 00:00:00

None

3295939b-f3c2-4960-8dc7-8545eecbf565

attack.execution

Nextron Sigma feed only (private)