AnyDesk adprinterpipe Named Pipe Created by Non-AnyDesk Process (LPE)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•7

Detects the creation of the '\adprinterpipe' named pipe by a process other than authorized AnyDesk binaries. This activity is indicative of a local privilege escalation (LPE) technique where an attacker pre-creates the pipe to impersonate the AnyDesk service and intercept a SYSTEM-level token.