Windows File Events: AnyDesk user.conf and system.conf Temporary Artefacts
Identifies Windows file writes of AnyDesk user.conf or system.conf in AppData\Roaming.
- Product
- windows
- Category
- file_event
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-02-11
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Windows file creation or access events where AnyDesk configuration files named user.conf and system.conf appear under the roaming AppData path. Adversaries can use legitimate remote support software like AnyDesk to establish interactive remote control, and these artefacts may indicate tool deployment or persistence within a user context. The detection relies on file event telemetry that includes the target filename containing the specified AnyDesk paths.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_anydesk_artefact.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows File Events: AnyDesk user.conf and system.conf Temporary Artefacts"
id: 8706cbd4-9429-49bd-865e-8030202a74bb
status: test
description: This rule flags Windows file creation or access events where AnyDesk configuration files named user.conf and system.conf appear under the roaming AppData path. Adversaries can use legitimate remote support software like AnyDesk to establish interactive remote control, and these artefacts may indicate tool deployment or persistence within a user context. The detection relies on file event telemetry that includes the target filename containing the specified AnyDesk paths.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_anydesk_artefact.yml
author: frack113, Huntrule Team
date: 2022-02-11
modified: 2024-07-20
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- \AppData\Roaming\AnyDesk\user.conf
- \AppData\Roaming\AnyDesk\system.conf
condition: selection
falsepositives:
- Legitimate use
level: medium
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_anydesk_artefact/info.yml
license: DRL-1.1
related:
- id: 0b9ad457-2554-44c1-82c2-d56a99c42377
type: derived