Windows AnyDesk Silent Installation via Command-Line Flags
Identifies AnyDesk being silently installed on Windows using --install, --start-with-win, and --silent command-line flags.
- Product
- windows
- Category
- process_creation
- Author
- Ján Trenčanský (SigmaHQ), DRL 1.1
- Published
- 2021-08-06
- Updated
- 2026-07-30
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags AnyDesk installations started with specific command-line arguments indicating a silent, unattended deployment. Attackers commonly use remote access tools to establish or maintain connectivity without user interaction, so these parameters can be a strong indicator of unauthorized tooling or deployment. It relies on Windows process creation telemetry and matches the presence of the --install, --start-with-win, and --silent flags in the command line.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows AnyDesk Silent Installation via Command-Line Flags
id: 78cd61bc-7ad1-4a61-ad92-bb0575c0cc0a
status: test
description: This rule flags AnyDesk installations started with specific command-line arguments indicating a silent, unattended deployment. Attackers commonly use remote access tools to establish or maintain connectivity without user interaction, so these parameters can be a strong indicator of unauthorized tooling or deployment. It relies on Windows process creation telemetry and matches the presence of the --install, --start-with-win, and --silent flags in the command line.
references:
- https://twitter.com/TheDFIRReport/status/1423361119926816776?s=20
- https://support.anydesk.com/Automatic_Deployment
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_silent_install.yml
author: Ján Trenčanský, Huntrule Team
date: 2021-08-06
modified: 2023-03-05
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains|all:
- --install
- --start-with-win
- --silent
condition: selection
falsepositives:
- Legitimate deployment of AnyDesk
level: high
license: DRL-1.1
related:
- id: 114e7f1c-f137-48c8-8f54-3088c24ce4b9
type: derived