Rule Info
Name
Remote Access Tool - AnyDesk Incoming Connection
Author
@d4ns4n_ (Wuerth-Phoenix)
Description
Detects incoming connections to AnyDesk. This could indicate a potential remote attacker trying to connect to a listening instance of AnyDesk and use it as potential command and control channel.
Date
2024-09-02 00:00:00
Modified
2025-02-24 00:00:00
Id
d58ba5c6-0ed7-4b9d-a433-6878379efda9
Tags
attack.persistence attack.command-and-control attack.t1219.002
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
phantinuss
Merge PR #5477 from @phantinuss - chore: update MITRE tag t1219 to t1219.002
2025-06-13
Swachchhanda Shrawan Poudel
Merge PR #5207 from @swachchhanda000 - Updated Anydesk related rules
2025-03-05
dan21san
Merge PR #4990 from @dan21san - Add `Remote Access Tool - AnyDesk Incoming Connection`
2024-09-02
Scan your endpoints, forensic images or collected files with our portable scanner THOR