AnyDesk Configuration File Activity

SigmaHQ Detections@sigmaHQ

•updated Jun 13, 2025•0•24

This rule detects the creation or modification of AnyDesk configuration files (user.conf and system.conf) in the AppData\Roaming\AnyDesk directory. Adversaries often use legitimate remote access tools like AnyDesk to establish command and control, and the presence of these configuration files can indicate its use on a system. This rule helps identify the presence of AnyDesk artifacts, which could be indicative of legitimate use or malicious activity.