Storm-1175 - PDQ Deploy Lateral Movement (T1570)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•3

Identifies Storm-1175 abusing legitimate enterprise software deployment tools like PDQ Deploy to push the Medusa encryptor to all domain endpoints simultaneously. The rule correlates process events related to PDQ Deploy with file events indicating the creation of files with a '.medusa' extension, which is characteristic of the Medusa ransomware.