AnyDesk Execution From Suspicious Folder
This rule detects the execution of AnyDesk, a legitimate remote access tool, from suspicious folders. Adversaries often use such tools to establish command and control channels. The rule specifically looks for AnyDesk executables (AnyDesk.exe or AnyDeskMSI.exe) that are not located in standard installation paths like 'Program Files' or 'AppData'.
Sigma
