AnyDesk Printer COM Impersonation LPE - SYSTEM Child Process Spawned

Ethan Andrews@eandrews

•updated Jun 28, 2026•0•0•1

Detects evidence of AnyDesk exploiting an COM impersonation vulnerability via the adprinterpipe named pipe. The rule monitors for AnyDesk spawning SYSTEM-level child processes, interaction with the adprinterpipe, or modification of critical print-related registry keys.