Windows: AnyDesk Execution Using Revoked Certificate Versions
Detects AnyDesk.exe execution on Windows when the file version matches known revoked-certificate releases (excluding uninstall/remove).
- Product
- windows
- Category
- process_creation
- Author
- Sai Prashanth Pulisetti, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-02-08
- Updated
- 2026-07-30
What it detects
This rule flags process creation events where AnyDesk is launched and the binary’s file version indicates a release prior to 8.0.8 (specific 7.x and 8.0.1–8.0.7 versions). Older versions are associated with a previously compromised signing certificate, so attackers could potentially sign binaries to evade detections. It relies on Windows process creation telemetry and file version information from the executed AnyDesk.exe. It excludes uninstall/remove command-line activity to reduce noise.
Reporting behind it
- bleepingcomputer.comhttps://www.bleepingcomputer.com/news/security/anydesk-says-hackers-breached-its-production-servers-reset-passwords/
- anydesk.comhttps://anydesk.com/en/changelog/windows
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_revoked_cert.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: AnyDesk Execution Using Revoked Certificate Versions"
id: b331b422-ea53-4b42-9c5f-c7d6b0cbebca
status: test
description: This rule flags process creation events where AnyDesk is launched and the binary’s file version indicates a release prior to 8.0.8 (specific 7.x and 8.0.1–8.0.7 versions). Older versions are associated with a previously compromised signing certificate, so attackers could potentially sign binaries to evade detections. It relies on Windows process creation telemetry and file version information from the executed AnyDesk.exe. It excludes uninstall/remove command-line activity to reduce noise.
references:
- https://www.bleepingcomputer.com/news/security/anydesk-says-hackers-breached-its-production-servers-reset-passwords/
- https://anydesk.com/en/changelog/windows
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_revoked_cert.yml
author: Sai Prashanth Pulisetti, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-02-08
tags:
- attack.execution
- attack.initial-access
logsource:
product: windows
category: process_creation
detection:
selection_img:
- Image|endswith: \AnyDesk.exe
- Description: AnyDesk
- Product: AnyDesk
- Company: AnyDesk Software GmbH
selection_version:
FileVersion|startswith:
- 7.0.
- 7.1.
- 8.0.1
- 8.0.2
- 8.0.3
- 8.0.4
- 8.0.5
- 8.0.6
- 8.0.7
filter_main_uninstall:
CommandLine|contains:
- " --remove"
- " --uninstall"
condition: all of selection_* and not 1 of filter_main_*
falsepositives:
- Unlikely
level: medium
license: DRL-1.1
related:
- id: 41f407b5-3096-44ea-a74f-96d04fbc41be
type: derived