Windows Service Installation of AnyDesk Software (Service Control Manager 7045)
Flags Windows service creation where AnyDesk appears in the service name and ImagePath via SCM Event ID 7045.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Service
- system
- Author
- Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-11
- Updated
- 2026-07-31
What it detects
This rule identifies Windows Service Control Manager events where a new service is installed and the service name contains both "AnyDesk" and "Service". It also requires the service ImagePath to include "AnyDesk", matching the installed binary path. Unauthorized AnyDesk service installation can indicate remote access software abuse, and it relies on Windows System telemetry for Service Control Manager event ID 7045.
Reporting behind it
- thedfirreport.comhttps://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
- thedfirreport.comhttps://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_anydesk.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-service-installation-of-anydesk-service-event-id-7045-530a6faa
title: Windows Service Installation of AnyDesk Software (Service Control Manager 7045)
id: b6fc8936-6a1a-4f8d-8188-9713f00d9781
status: test
description: This rule identifies Windows Service Control Manager events where a new service is installed and the service name contains both "AnyDesk" and "Service". It also requires the service ImagePath to include "AnyDesk", matching the installed binary path. Unauthorized AnyDesk service installation can indicate remote access software abuse, and it relies on Windows System telemetry for Service Control Manager event ID 7045.
references:
- https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
- https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_anydesk.yml
author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2022-08-11
modified: 2025-02-24
tags:
- attack.persistence
logsource:
product: windows
service: system
detection:
selection_provider:
Provider_Name: Service Control Manager
EventID: 7045
selection_service:
- ServiceName|contains|all:
- AnyDesk
- Service
- ImagePath|contains: AnyDesk
condition: all of selection_*
falsepositives:
- Legitimate usage of the anydesk tool
level: medium
license: DRL-1.1
related:
- id: 530a6faa-ff3d-4022-b315-50828e77eef5
type: derived