AnyDesk Temporary Artefact File Writes on Windows

title: AnyDesk Temporary Artefact File Writes on Windows
id: 8706cbd4-9429-49bd-865e-8030202a74bb
status: test
description: This rule flags creation of AnyDesk configuration/artefact files in a user’s AppData roaming directories, specifically user.conf and system.conf. Attackers can abuse legitimate remote support software to establish interactive access and command-and-control capability; these on-disk artefacts can provide a filesystem-based indicator. Detection relies on Windows file event telemetry that records TargetFilename matches containing the specified AnyDesk paths.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_anydesk_artefact.yml
author: frack113, Huntrule Team
date: 2022-02-11
modified: 2024-07-20
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - \AppData\Roaming\AnyDesk\user.conf
      - \AppData\Roaming\AnyDesk\system.conf
  condition: selection
falsepositives:
  - Legitimate use
level: medium
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_anydesk_artefact/info.yml
license: DRL-1.1
related:
  - id: 0b9ad457-2554-44c1-82c2-d56a99c42377
    type: derived