Remote Management and Monitoring tool - PDQ - Network Connection

Description

Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels. https://github.com/jischell-msft/RemoteManagementMonitoringTools

Query · kql

let Time_start = now(-5d);
let Time_end = now();
//
DeviceNetworkEvents
| where Timestamp between (Time_start..Time_end)
| where RemoteUrl has_any (
        'app.pdq.com',
        'connect-package-library.e9d69694c3d8f7465fd531512c22bd0f.r2.cloudflarestorage.com',
        'connect.e9d69694c3d8f7465fd531512c22bd0f.r2.cloudflarestorage.com',
        'cfcdn.pdq.com'
    )
    and InitiatingProcessVersionInfoProductName has 'PDQConnectAgent'
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), 
    Report=make_set(ReportId), Count=count() by DeviceId, DeviceName,
    RemoteUrl
Raw source Remote Management and Monitoring tool - PDQ - Network Connection · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 58cbbe97-f835-4677-9bee-203b1df29600
name: Remote Management and Monitoring tool - PDQ - Network Connection
description: |
    Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
    https://github.com/jischell-msft/RemoteManagementMonitoringTools
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceNetworkEvents
tactics: CommandAndControl
relevantTechniques: T1219
query: |
  let Time_start = now(-5d);
  let Time_end = now();
  //
  DeviceNetworkEvents
  | where Timestamp between (Time_start..Time_end)
  | where RemoteUrl has_any (
          'app.pdq.com',
          'connect-package-library.e9d69694c3d8f7465fd531512c22bd0f.r2.cloudflarestorage.com',
          'connect.e9d69694c3d8f7465fd531512c22bd0f.r2.cloudflarestorage.com',
          'cfcdn.pdq.com'
      )
      and InitiatingProcessVersionInfoProductName has 'PDQConnectAgent'
  | summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), 
      Report=make_set(ReportId), Count=count() by DeviceId, DeviceName,
      RemoteUrl

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.