Windows AnyDesk Incoming Remote Connection (Non-Initiated Network Sessions)

Alerts on non-initiated (incoming) network connections tied to AnyDesk.exe or AnyDeskMSI.exe on Windows.

FreeUnreviewedSigmamediumv1

windows-anydesk-incoming-remote-connection-non-initiated-network-sessions-d58ba5c6

title: Windows AnyDesk Incoming Remote Connection (Non-Initiated Network Sessions)
id: 6c47eead-f337-43b2-b809-551892443775
status: experimental
description: This rule flags network connections on Windows where AnyDesk.exe or AnyDeskMSI.exe is the process image and the connection is not initiated by the local host. Incoming sessions can indicate an external system reaching a listening AnyDesk instance, potentially enabling remote access as a command-and-control channel. It relies on Windows network connection telemetry that includes the connecting process image path and whether the session was initiated remotely.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows
  - https://asec.ahnlab.com/en/40263/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_remote_access_tools_anydesk_incoming_connection.yml
author: "@d4ns4n_ (Wuerth-Phoenix), Huntrule Team"
date: 2024-09-02
modified: 2025-02-24
tags:
  - attack.persistence
  - attack.command-and-control
  - attack.t1219.002
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - \AnyDesk.exe
      - \AnyDeskMSI.exe
    Initiated: "false"
  condition: selection
falsepositives:
  - Legitimate incoming connections (e.g. sysadmin activity). Most of the time I would expect outgoing connections (initiated locally).
level: medium
license: DRL-1.1
related:
  - id: d58ba5c6-0ed7-4b9d-a433-6878379efda9
    type: derived

What it detects

This rule flags network connections on Windows where AnyDesk.exe or AnyDeskMSI.exe is the process image and the connection is not initiated by the local host. Incoming sessions can indicate an external system reaching a listening AnyDesk instance, potentially enabling remote access as a command-and-control channel. It relies on Windows network connection telemetry that includes the connecting process image path and whether the session was initiated remotely.

Known false positives

Legitimate incoming connections (e.g. sysadmin activity). Most of the time I would expect outgoing connections (initiated locally).

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.