AnyDesk/N-able RMM LNK Impersonation for Persistent Access (Operation Escaneo)

Ibrahim Saud@tektrix

•updated Jun 25, 2026•1•0•6

This rule detects the creation or modification of specific files associated with known malicious activity or remote access tools, specifically looking for shortcut files (LNK) named 'ApplianceConfig', 'ServerConfig', 'CredentialsConfig', or AnyDesk configuration files ('anydesk_svc.conf', 'anydesk_usr.conf'). These file patterns are often used by threat actors for persistence or to facilitate remote control.