AnyDesk Printer Named Pipe COM Impersonation LPE - adprinterpipe
This rule detects potential local privilege escalation attempts targeting the AnyDesk printer service. The rule monitors for unauthorized COM server registration (COM hijacking) and the subsequent spawning of suspicious child processes (e.g., cmd.exe, PowerShell) directly linked to the AnyDesk process tree. This behavior is indicative of exploiting the AnyDesk COM object printer impersonation vulnerability to gain NT AUTHORITY\SYSTEM privileges.
Cortex XDR
