AnyDesk Executable Execution on Windows

title: AnyDesk Executable Execution on Windows
id: 615ded7c-e69a-46f3-8797-afc49f2a66ce
status: test
related:
  - id: 065b00ca-5d5c-4557-ac95-64a6d0b64d86
    type: similar
  - id: b52e84a3-029e-4529-b09b-71d19dd27e94
    type: derived
description: This rule flags process creation on Windows when AnyDesk executables are launched. Attackers can use AnyDesk to establish interactive remote access and maintain command-and-control capabilities through a legitimate remote support tool. It relies on process creation telemetry and matches on the executable filename endings and product/company/description fields identifying AnyDesk.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows
  - https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_anydesk.yml
author: frack113, Huntrule Team
date: 2022-02-11
modified: 2025-02-24
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith:
        - \AnyDesk.exe
        - \AnyDeskMSI.exe
    - Description: AnyDesk
    - Product: AnyDesk
    - Company: AnyDesk Software GmbH
  condition: selection
falsepositives:
  - Legitimate use
level: medium
license: DRL-1.1