Remote Access Tool - AnyDesk Execution With Known Revoked Signing Certificate
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects the execution of an AnyDesk binary with a version prior to 8.0.8. Prior to version 8.0.8, the Anydesk application used a signing certificate that got compromised by threat actors. Use this rule to detect instances of older versions of Anydesk using the compromised certificate This is recommended in order to avoid attackers leveraging the certificate and signing their binaries to bypass detections.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Process started" AND ((PROCESSNAME endswith "\AnyDesk.exe" OR MESSAGE = "AnyDesk" OR PRODUCT_NAME = "AnyDesk" OR COMPANY_NAME = "AnyDesk Software GmbH") AND VERSION startswith "7.0.,7.1.,8.0.1,8.0.2,8.0.3,8.0.4,8.0.5,8.0.6,8.0.7") AND COMMANDLINE notcontains " --remove, --uninstall" select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Sai Prashanth Pulisetti, Nasreddine Bencherchali (Nextron Systems)
