Windows: AnyDesk Execution Using Revoked Certificate Versions

title: "Windows: AnyDesk Execution Using Revoked Certificate Versions"
id: b331b422-ea53-4b42-9c5f-c7d6b0cbebca
status: test
description: This rule flags process creation events where AnyDesk is launched and the binary’s file version indicates a release prior to 8.0.8 (specific 7.x and 8.0.1–8.0.7 versions). Older versions are associated with a previously compromised signing certificate, so attackers could potentially sign binaries to evade detections. It relies on Windows process creation telemetry and file version information from the executed AnyDesk.exe. It excludes uninstall/remove command-line activity to reduce noise.
references:
  - https://www.bleepingcomputer.com/news/security/anydesk-says-hackers-breached-its-production-servers-reset-passwords/
  - https://anydesk.com/en/changelog/windows
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_revoked_cert.yml
author: Sai Prashanth Pulisetti, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-02-08
tags:
  - attack.execution
  - attack.initial-access
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \AnyDesk.exe
    - Description: AnyDesk
    - Product: AnyDesk
    - Company: AnyDesk Software GmbH
  selection_version:
    FileVersion|startswith:
      - 7.0.
      - 7.1.
      - 8.0.1
      - 8.0.2
      - 8.0.3
      - 8.0.4
      - 8.0.5
      - 8.0.6
      - 8.0.7
  filter_main_uninstall:
    CommandLine|contains:
      - " --remove"
      - " --uninstall"
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: medium
license: DRL-1.1
related:
  - id: 41f407b5-3096-44ea-a74f-96d04fbc41be
    type: derived