Suspicious Anydesk Remote Access Software Service Deployment (via system)

title: Suspicious Anydesk Remote Access Software Service Deployment (via system)
id: 0e9f5418-bab7-5b08-9772-ebb8782233a2
status: stable
description: This rule detects the installation of the anydesk software service. Which could be an indication of anydesk misuse if you the software isn't already used.
references:
    - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
    - https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/
author: Huntrule Team
date: 2026-06-25
tags:
    - attack.persistence
    - attack.command-and-control
    - attack.t1219
    - attack.t1543.003
logsource:
    product: windows
    service: system
detection:
    selection_provider:
        Provider_Name: 'Service Control Manager'
        EventID: 7045
    selection_service:
        - ServiceName|contains|all:
              - 'AnyDesk'
              - 'Service'
        - ImagePath|contains: 'AnyDesk'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium