Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
AnyDesk is a legitimate remote control tool widely abused by actors to access victim machines and deploy malware or ransomware. This hunt excludes common AnyDesk install paths, surfacing execution from directories such as Temp, ProgramData or System32.
| Attribute | Value |
|---|---|
| Type | Hunting Query |
| Solution | Intel471 |
| ID | 93f71607-f35d-4aa6-aec9-c2f8a62cbd8a |
| Tactics | CommandAndControl |
| Techniques | T1219 |
| Required Connectors | SecurityEvents, WindowsSecurityEvents |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
SecurityEvent |
Activity has "Process"NewProcessName endswith "AnyDesk.exe"NewProcessName has_any "\\AppData\\" |
✓ | ✓ | ✓ |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊