Windows AnyDesk Executed from Suspicious Directory

Alerts on AnyDesk execution from non-standard folders on Windows, indicating potential remote access abuse.

FreeUnreviewedSigmahighv1

windows-anydesk-executed-from-suspicious-directory-065b00ca

title: Windows AnyDesk Executed from Suspicious Directory
id: 6cd44176-5a21-464a-a8d8-c4d7f9706fd1
related:
  - id: b52e84a3-029e-4529-b09b-71d19dd27e94
    type: similar
  - id: 065b00ca-5d5c-4557-ac95-64a6d0b64d86
    type: derived
status: test
description: This rule flags process creation events where AnyDesk-related executables (AnyDesk.exe or AnyDeskMSI.exe) are started with metadata indicating AnyDesk, but the process path is not located in common AnyDesk installation locations. Attackers may abuse legitimate remote access software to establish interactive command-and-control capabilities, making unexpected execution paths a useful indicator of compromise. It relies on Windows process creation telemetry, including executable image paths and product/company/description fields.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows
  - https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_susp_exec.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-05-20
modified: 2025-02-24
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith:
        - \AnyDesk.exe
        - \AnyDeskMSI.exe
    - Description: AnyDesk
    - Product: AnyDesk
    - Company: AnyDesk Software GmbH
  filter:
    Image|contains:
      - \AppData\
      - Program Files (x86)\AnyDesk
      - Program Files\AnyDesk
  condition: selection and not filter
falsepositives:
  - Legitimate use of AnyDesk from a non-standard folder
level: high
license: DRL-1.1

What it detects

This rule flags process creation events where AnyDesk-related executables (AnyDesk.exe or AnyDeskMSI.exe) are started with metadata indicating AnyDesk, but the process path is not located in common AnyDesk installation locations. Attackers may abuse legitimate remote access software to establish interactive command-and-control capabilities, making unexpected execution paths a useful indicator of compromise. It relies on Windows process creation telemetry, including executable image paths and product/company/description fields.

Known false positives

Legitimate use of AnyDesk from a non-standard folder

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.