Remote Access Tool - AnyDesk Silent Installation

Title: Remote Access Tool - AnyDesk Silent Installation
Status: test
Description:Detects AnyDesk Remote Desktop silent installation. Which can be used by attackers to gain remote access.
References:
  -https://twitter.com/TheDFIRReport/status/1423361119926816776?s=20
  -https://support.anydesk.com/Automatic_Deployment
Author: Ján Trenčanský
Date: 2021-08-06
modified:2023-03-05
Tags:

• -'attack.command-and-control'
• -'attack.t1219.002'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains|all:
      -'--install'
      -'--start-with-win'
      -'--silent'

  condition:selection
Falsepositives:
  -Legitimate deployment of AnyDesk
Level: high