Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

AnyDesk Used as Persistent C2

Darshan Thummar@Mighty

•updated Jun 27, 2026•2•0•3

Detects AnyDesk remote desktop used as persistent unauthorized C2 channel

Microsoft Sentinel (KQL)

Tags

T1219.002 - Remote Desktop Software TA0011 - Command and Control Process Creation Remote Access Session Windows Windows Defender Atpkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?