CmdID

CmdID / Files

AnyDesk.exe

AnyDesk is a popular remote desktop software that enables users to access and control a computer or device from a remote location. LOLRMM

Program on Windows LOLRMM AnyDesk 5 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

A file of AnyDesk

a remote management tool, from LOLRMM

LOLRMM lists a file named AnyDesk.exe as AnyDesk’s.

Its sitehttps://anydesk.com/en

From LOLRMM (Apache 2.0), which lists the remote management tools intruders are known to use as well as administrators. It goes by the file’s name.

What detects it

Sigma process creation rules that name AnyDesk.exe
highRemote Access Tool - Anydesk Execution From Suspicious FolderFlorian Roth (Nextron Systems)
mediumRemote Access Tool - AnyDesk Executionfrack113
mediumRemote Access Tool - AnyDesk Execution With Known Revoked Signing CertificateSai Prashanth Pulisetti, Nasreddine Bencherchali (Nextron Systems)

Sigma names AnyDesk.exe in 5 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.