Windows Service Installation of AnyDesk Service (Event ID 7045)

Flags Windows service creation where AnyDesk appears in the service name and ImagePath via SCM Event ID 7045.

FreeUnreviewedSigmamediumv1

windows-service-installation-of-anydesk-service-event-id-7045-530a6faa

title: Windows Service Installation of AnyDesk Service (Event ID 7045)
id: b6fc8936-6a1a-4f8d-8188-9713f00d9781
status: test
description: This rule identifies creation of a Windows service via the Service Control Manager (Event ID 7045) where the service name contains both "AnyDesk" and "Service", and the ImagePath includes "AnyDesk". Attackers may install remote access tooling as a persistent service to maintain ongoing remote connectivity. Telemetry required includes Windows System service installation events capturing the provider name, service name, and image path.
references:
  - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
  - https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_anydesk.yml
author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2022-08-11
modified: 2025-02-24
tags:
  - attack.persistence
logsource:
  product: windows
  service: system
detection:
  selection_provider:
    Provider_Name: Service Control Manager
    EventID: 7045
  selection_service:
    - ServiceName|contains|all:
        - AnyDesk
        - Service
    - ImagePath|contains: AnyDesk
  condition: all of selection_*
falsepositives:
  - Legitimate usage of the anydesk tool
level: medium
license: DRL-1.1
related:
  - id: 530a6faa-ff3d-4022-b315-50828e77eef5
    type: derived

What it detects

This rule identifies creation of a Windows service via the Service Control Manager (Event ID 7045) where the service name contains both "AnyDesk" and "Service", and the ImagePath includes "AnyDesk". Attackers may install remote access tooling as a persistent service to maintain ongoing remote connectivity. Telemetry required includes Windows System service installation events capturing the provider name, service name, and image path.

Known false positives

Legitimate usage of the anydesk tool

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.