AnyDesk and N-able RMM LNK Impersonation for Persistent Access (MexicanMafia)

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•2

Detects indicators of abuse involving remote monitoring and management (RMM) tools like AnyDesk and N-able. The rule identifies suspicious LNK files masquerading as software configuration, configuration files placed in non-standard locations, the addition of RMM components to Windows Registry run keys, and the execution of RMM agents with silent flags, all of which are common tactics for establishing persistence and unauthorized remote access.