AnyDesk Windows: suspicious executable/DLL writes excluding gcapi.dll
Alerts when AnyDesk.exe or AnyDeskMSI.exe writes .dll/.exe files, excluding gcapi.dll.
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-09-28
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags file events where AnyDesk (AnyDesk.exe or AnyDeskMSI.exe) writes executable files or DLLs to disk, excluding the legitimate gcapi.dll. Such behavior can indicate unwanted or malicious payload staging via a remote access tool, where binaries are dropped for execution or further compromise. It relies on Windows file write telemetry that records the process image name and the target filename being created.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "AnyDesk Windows: suspicious executable/DLL writes excluding gcapi.dll"
id: 35006156-e7fd-4f1f-9b35-a89030874e60
status: test
description: This rule flags file events where AnyDesk (AnyDesk.exe or AnyDeskMSI.exe) writes executable files or DLLs to disk, excluding the legitimate gcapi.dll. Such behavior can indicate unwanted or malicious payload staging via a remote access tool, where binaries are dropped for execution or further compromise. It relies on Windows file write telemetry that records the process image name and the target filename being created.
references:
- https://redcanary.com/blog/misbehaving-rats/
- https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_anydesk_writing_susp_binaries.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-09-28
modified: 2025-02-24
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
product: windows
category: file_event
detection:
selection:
Image|endswith:
- \AnyDesk.exe
- \AnyDeskMSI.exe
TargetFilename|endswith:
- .dll
- .exe
filter_dlls:
TargetFilename|endswith: \gcapi.dll
condition: selection and not 1 of filter_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 2d367498-5112-4ae5-a06a-96e7bc33a211
type: derived