AnyDesk Printer adprinterpipe COM Impersonation LPE (CVE-2026-45115)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•3

This rule detects potential local privilege escalation attempts targeting the AnyDesk service. An attacker can exploit the insecure permissions of the 'adprinterpipe' named pipe created by the AnyDesk service to impersonate a client and execute arbitrary commands with NT AUTHORITY\SYSTEM privileges. The rule monitors for suspicious process creation, COM registration changes, anomalous pipe connections, and suspicious DLL loads stemming from AnyDesk processes.