AnyDesk Executable Execution on Windows
Detects AnyDesk-related process launches on Windows by matching executable names and AnyDesk product metadata.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-02-11
- Updated
- 2026-07-30
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags process creation on Windows when AnyDesk executables are launched. Attackers can use AnyDesk to establish interactive remote access and maintain command-and-control capabilities through a legitimate remote support tool. It relies on process creation telemetry and matches on the executable filename endings and product/company/description fields identifying AnyDesk.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows
- thedfirreport.comhttps://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_anydesk.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: AnyDesk Executable Execution on Windows
id: 615ded7c-e69a-46f3-8797-afc49f2a66ce
status: test
related:
- id: 065b00ca-5d5c-4557-ac95-64a6d0b64d86
type: similar
- id: b52e84a3-029e-4529-b09b-71d19dd27e94
type: derived
description: This rule flags process creation on Windows when AnyDesk executables are launched. Attackers can use AnyDesk to establish interactive remote access and maintain command-and-control capabilities through a legitimate remote support tool. It relies on process creation telemetry and matches on the executable filename endings and product/company/description fields identifying AnyDesk.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows
- https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_anydesk.yml
author: frack113, Huntrule Team
date: 2022-02-11
modified: 2025-02-24
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith:
- \AnyDesk.exe
- \AnyDeskMSI.exe
- Description: AnyDesk
- Product: AnyDesk
- Company: AnyDesk Software GmbH
condition: selection
falsepositives:
- Legitimate use
level: medium
license: DRL-1.1