AnyDesk COM Printer Pipe Impersonation LPE (adprinterpipe / HKCU CLSID hijack)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

Detects local privilege escalation attempts targeting AnyDesk by exploiting COM object registration. The attack involves registering a malicious COM server in HKCU to intercept the AnyDesk service's interaction with the print pipe, followed by process token impersonation to gain SYSTEM privileges. The rule monitors for unauthorized COM registration, anomalous process execution from AnyDesk, and cross-process access.