Windows: Suspicious AnyDesk Binary Writes Except gcapi.dll

title: "Windows: Suspicious AnyDesk Binary Writes Except gcapi.dll"
id: 35006156-e7fd-4f1f-9b35-a89030874e60
status: test
description: This rule flags file creation events where AnyDesk executables (AnyDesk.exe or AnyDeskMSI.exe) write files ending in .dll or .exe to disk, excluding writes to gcapi.dll. Attackers may abuse AnyDesk to drop or stage payloads under the guise of a legitimate remote access tool, making suspicious binary writes an important indicator of compromise. It relies on Windows file event telemetry that records the process image and the target filename.
references:
  - https://redcanary.com/blog/misbehaving-rats/
  - https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_anydesk_writing_susp_binaries.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-28
modified: 2025-02-24
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith:
      - \AnyDesk.exe
      - \AnyDeskMSI.exe
    TargetFilename|endswith:
      - .dll
      - .exe
  filter_dlls:
    TargetFilename|endswith: \gcapi.dll
  condition: selection and not 1 of filter_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 2d367498-5112-4ae5-a06a-96e7bc33a211
    type: derived