Windows Incoming AnyDesk Connection via AnyDesk.exe or AnyDeskMSI.exe
Alerts on non-initiated (incoming) network connections tied to AnyDesk.exe or AnyDeskMSI.exe on Windows.
- Product
- windows
- Category
- network_connection
- Author
- @d4ns4n_ (Wuerth-Phoenix) (SigmaHQ), DRL 1.1
- Published
- 2024-09-02
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags network connections where the process image ends with AnyDesk.exe or AnyDeskMSI.exe and the connection is marked as incoming (Initiated is false). Incoming AnyDesk connections can indicate an external actor reaching a listening remote access component to establish a command-and-control path. The detection relies on Windows network connection telemetry that includes the initiating status and the process image path.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows
- asec.ahnlab.comhttps://asec.ahnlab.com/en/40263/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_remote_access_tools_anydesk_incoming_connection.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Incoming AnyDesk Connection via AnyDesk.exe or AnyDeskMSI.exe
id: 6c47eead-f337-43b2-b809-551892443775
status: experimental
description: This rule flags network connections where the process image ends with AnyDesk.exe or AnyDeskMSI.exe and the connection is marked as incoming (Initiated is false). Incoming AnyDesk connections can indicate an external actor reaching a listening remote access component to establish a command-and-control path. The detection relies on Windows network connection telemetry that includes the initiating status and the process image path.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows
- https://asec.ahnlab.com/en/40263/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_remote_access_tools_anydesk_incoming_connection.yml
author: "@d4ns4n_ (Wuerth-Phoenix), Huntrule Team"
date: 2024-09-02
modified: 2025-02-24
tags:
- attack.persistence
- attack.command-and-control
- attack.t1219.002
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith:
- \AnyDesk.exe
- \AnyDeskMSI.exe
Initiated: "false"
condition: selection
falsepositives:
- Legitimate incoming connections (e.g. sysadmin activity). Most of the time I would expect outgoing connections (initiated locally).
level: medium
license: DRL-1.1
related:
- id: d58ba5c6-0ed7-4b9d-a433-6878379efda9
type: derived