AnyDesk Remote Desktop Used as C2 Channel
This rule detects network traffic indicative of AnyDesk remote desktop software being used as a command and control (C2) channel. It specifically looks for HTTP requests to 'anydesk.com' or 'relay.anydesk.com' domains. A threshold of 5 connections within 60 seconds from the same source IP is set to reduce false positives.
Suricata
