AnyDesk Printer COM Object Impersonation LPE - Suspicious Child Process

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

Detects suspicious child processes spawned by AnyDesk.exe or AnyDesk-runtime.exe that may indicate local privilege escalation. This rule specifically targets the abuse of the adprinterpipe named pipe and CoUnmarshalInterface to impersonate SYSTEM-level AnyDesk processes, allowing for the execution of unauthorized child processes.