Remote Access Tool - AnyDesk Execution With Known Revoked Signing Certificate
Detects the execution of an AnyDesk binary with a version prior to 8.0.8. Prior to version 8.0.8, the Anydesk application used a signing certificate that got compromised by threat actors. This rule helps detect instances of older versions of Anydesk using the compromised certificate, which is recommended to avoid attackers leveraging the certificate to sign their binaries and bypass detections.
Sigma
