Sigma rule: Remote Access Tool - AnyDesk Incoming Connection

Rule

Title

Remote Access Tool - AnyDesk Incoming Connection

Status

experimental

Level

medium

Author

@d4ns4n_ (Wuerth-Phoenix)

Date

2024-09-02

Modified

2025-02-24

File

rules/windows/network_connection/net_connection_win_remote_access_tools_anydesk_incoming_connection.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects incoming connections to AnyDesk. This could indicate a potential remote attacker trying to connect to a listening instance of AnyDesk and use it as potential command and control channel.

Log source

product

windows

category

network_connection

Detection

selection:
    Image|endswith:
        - '\AnyDesk.exe'
        - '\AnyDeskMSI.exe'
    Initiated: 'false' # If the network connection is initiated remotely (incoming), the field is set to false.
condition: selection

False positives (as the rule lists them)

• Legitimate incoming connections (e.g. sysadmin activity). Most of the time I would expect outgoing connections (initiated locally).

Tags

• attack.persistence
• attack.command-and-control
• attack.t1219.002

MITRE ATT&CK ids this rule names

• T1219.002

References

• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows
• https://asec.ahnlab.com/en/40263/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/network_connection/net_connection_win_remote_access_tools_anydesk_incoming_connection.yml