Windows AnyDesk Executed from Suspicious Directory
Alerts on AnyDesk execution from non-standard folders on Windows, indicating potential remote access abuse.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-05-20
- Updated
- 2026-07-30
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags process creation events where AnyDesk-related executables (AnyDesk.exe or AnyDeskMSI.exe) are started with metadata indicating AnyDesk, but the process path is not located in common AnyDesk installation locations. Attackers may abuse legitimate remote access software to establish interactive command-and-control capabilities, making unexpected execution paths a useful indicator of compromise. It relies on Windows process creation telemetry, including executable image paths and product/company/description fields.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows
- thedfirreport.comhttps://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_susp_exec.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows AnyDesk Executed from Suspicious Directory
id: 6cd44176-5a21-464a-a8d8-c4d7f9706fd1
related:
- id: b52e84a3-029e-4529-b09b-71d19dd27e94
type: similar
- id: 065b00ca-5d5c-4557-ac95-64a6d0b64d86
type: derived
status: test
description: This rule flags process creation events where AnyDesk-related executables (AnyDesk.exe or AnyDeskMSI.exe) are started with metadata indicating AnyDesk, but the process path is not located in common AnyDesk installation locations. Attackers may abuse legitimate remote access software to establish interactive command-and-control capabilities, making unexpected execution paths a useful indicator of compromise. It relies on Windows process creation telemetry, including executable image paths and product/company/description fields.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows
- https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_susp_exec.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-05-20
modified: 2025-02-24
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith:
- \AnyDesk.exe
- \AnyDeskMSI.exe
- Description: AnyDesk
- Product: AnyDesk
- Company: AnyDesk Software GmbH
filter:
Image|contains:
- \AppData\
- Program Files (x86)\AnyDesk
- Program Files\AnyDesk
condition: selection and not filter
falsepositives:
- Legitimate use of AnyDesk from a non-standard folder
level: high
license: DRL-1.1