Windows AnyDesk Silent Installation via Command-Line Flags

Identifies AnyDesk being silently installed on Windows using --install, --start-with-win, and --silent command-line flags.

FreeUnreviewedSigmahighv1

windows-anydesk-silent-installation-via-command-line-flags-114e7f1c

title: Windows AnyDesk Silent Installation via Command-Line Flags
id: 78cd61bc-7ad1-4a61-ad92-bb0575c0cc0a
status: test
description: This rule flags AnyDesk installations started with specific command-line arguments indicating a silent, unattended deployment. Attackers commonly use remote access tools to establish or maintain connectivity without user interaction, so these parameters can be a strong indicator of unauthorized tooling or deployment. It relies on Windows process creation telemetry and matches the presence of the --install, --start-with-win, and --silent flags in the command line.
references:
  - https://twitter.com/TheDFIRReport/status/1423361119926816776?s=20
  - https://support.anydesk.com/Automatic_Deployment
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_silent_install.yml
author: Ján Trenčanský, Huntrule Team
date: 2021-08-06
modified: 2023-03-05
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - --install
      - --start-with-win
      - --silent
  condition: selection
falsepositives:
  - Legitimate deployment of AnyDesk
level: high
license: DRL-1.1
related:
  - id: 114e7f1c-f137-48c8-8f54-3088c24ce4b9
    type: derived

What it detects

This rule flags AnyDesk installations started with specific command-line arguments indicating a silent, unattended deployment. Attackers commonly use remote access tools to establish or maintain connectivity without user interaction, so these parameters can be a strong indicator of unauthorized tooling or deployment. It relies on Windows process creation telemetry and matches the presence of the --install, --start-with-win, and --silent flags in the command line.

Known false positives

Legitimate deployment of AnyDesk

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.