Query: rule covering Detects the execution of an AnyDesk binary with a version prior to 8.0.8. Prior to version 8.0.8, the Anydesk applicatio
Matching passage: Sigma rule: Detects the execution of an AnyDesk binary with a version prior to 8.0.8. Prior to version 8.0.8, the Anydesk applicatio. Logsource: windows / process_creation. Rule: title: Remote Access Tool - AnyDesk Execution With Known Revoked Signing Certificate id: 41f407b5-3096-44ea-a74f-96d04fbc41be status: test description: 'Detects the execution of an AnyDesk binary with a version prior to 8.0.8. Prior to version 8.0.8, the Anydesk application used a signing certificate that got compromised by threat actors. Use this rule to detect instances of older versions of Anydesk using the compromised certificate This is recommended in order to avoid attackers leveraging the certificate and signing their binaries to bypass detections. ' references: - https://www.bleepingcomputer.com/news/security/anydesk-says-hackers-breached-its-production-servers-reset-passwords/ - https://anydesk.com/en/changelog/windows author: Sai Prashanth Pulisetti, Nasreddine Bencherchali (Nextron Systems) date: 2024-02-08 tags: - attack.execution - attack.initial-access logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \AnyDesk.exe - Description: AnyDesk - Product: AnyDesk - Company: AnyDesk Software GmbH selection_version: FileVersion|startswith: - 7.0. - 7.1. - 8.0.1 - 8.0.2 - 8.0.3 - 8.0.4 - 8.0.5 - 8.0.6 - 8.0.7 filter_main_uninstall: CommandLine|contains: - ' --remove' - ' --uninstall' condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unlikely level: medium
Near-miss passage: Sigma rule: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm. Logsource: windows / process_creation. Rule: title: Remote Access Tool - Anydesk Execution From Suspicious Folder id: 065b00ca-5d5c-4557-ac95-64a6d0b64d86 related: - id: b52e84a3-029e-4529-b09b-71d19dd27e94 type: similar status: test description: 'An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows - https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/ author: Florian Roth (Nextron Systems) date: 2022-05-20 modified: 2025-02-24 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \AnyDesk.exe - \AnyDeskMSI.exe - Description: AnyDesk - Product: AnyDesk - Company: AnyDesk Software GmbH filter: Image|contains: - \AppData\ - Program Files (x86)\AnyDesk - Program Files\AnyDesk condition: selection and not filter falsepositives: - Legitimate use of AnyDesk from a non-standard folder level: high