Remote Access Utility - Anydesk Execution From Suspicious Folder (via process_creation)
This rule detects an adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are frequently used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software frequently used by adversaries. (Citation: Symantec Living off the Land)
Unlock this rule to view and copy it
Rule logic is available with an unlock credit. The public page keeps its context, mappings and implementation details visible.
Sign in to unlockKnown false positives
- Unknown
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.