TL;DR: there's no rule, it totally depends on implementation done by developper who implemented the software.
When a program uses PAM for authentication, it have to call
pam_start() function. Prototype of
pam_start() is the following:
int pam_start(const char *service_name, const char *user, const struct pam_conv *pam_conversation, pam_handle_t **pamh);
(See manpage for more details).
The first argument,
service_name is the one used.
When having a look to OpenSSH source code, you may see the following in file
debug("PAM: initializing for \"%s\"", user);
pam_start(SSHD_PAM_SERVICE, user, &store_conv, &sshpam_handle);
sshpam_authctxt = authctxt;
And if you search (in the same file) for constant
SSH_PAM_SERVICE you would see:
extern char *__progname;
# define SSHD_PAM_SERVICE __progname
Next step is getting value of
__progname. Let's grep the whole OpenSSH source code and ... wait:
ssh.c: __progname = ssh_get_progname(av);
As you may know,
av in C is the name of the binary. So, in my system, the service name will be
sshd since this is the name of the OpenSSH daemon binary.
NOTE: I took some shortcuts because i ignore the content of
ssh_get_progname()... but i think this small study is enough to illustrate my answer :)