Sigma rule: Remote Access Tool - AnyDesk Execution With Known Revoked Signing Certificate

Rule

Title

Remote Access Tool - AnyDesk Execution With Known Revoked Signing Certificate

Status

test

Level

medium

Author

Sai Prashanth Pulisetti, Nasreddine Bencherchali (Nextron Systems)

Date

2024-02-08

File

rules/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_revoked_cert.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of an AnyDesk binary with a version prior to 8.0.8.
Prior to version 8.0.8, the Anydesk application used a signing certificate that got compromised by threat actors.
Use this rule to detect instances of older versions of Anydesk using the compromised certificate
This is recommended in order to avoid attackers leveraging the certificate and signing their binaries to bypass detections.

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Image|endswith: '\AnyDesk.exe'
    - Description: 'AnyDesk'
    - Product: 'AnyDesk'
    - Company: 'AnyDesk Software GmbH'
selection_version:
    FileVersion|startswith:
        - '7.0.'
        - '7.1.'
        - '8.0.1'
        - '8.0.2'
        - '8.0.3'
        - '8.0.4'
        - '8.0.5'
        - '8.0.6'
        - '8.0.7'
filter_main_uninstall:
    CommandLine|contains:
        - ' --remove'
        - ' --uninstall'
condition: all of selection_* and not 1 of filter_main_*

False positives (as the rule lists them)

• Unlikely

Tags

• attack.execution
• attack.initial-access

References

• https://www.bleepingcomputer.com/news/security/anydesk-says-hackers-breached-its-production-servers-reset-passwords/
• https://anydesk.com/en/changelog/windows

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_revoked_cert.yml