Remote Access Tool - AnyDesk Execution
This rule detects the execution of AnyDesk, a legitimate remote access tool. Adversaries often abuse such tools to establish command and control (C2) channels to target systems, as they are commonly allowed by application control and can blend in with normal network traffic. The detection logic looks for specific image names, descriptions, product names, or company names associated with AnyDesk during process creation events.
Sigma
