AnyDesk Printer COM Impersonation LPE — Unexpected Child Process or adprinterpipe Access

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

This rule detects suspicious activities associated with the exploitation of AnyDesk, specifically targeting COM printer impersonation for privilege escalation and subsequent persistence. It monitors for: 1) AnyDesk or AnyDesk-runtime spawning suspicious child processes (e.g., cmd, powershell, sc), 2) unauthorized processes accessing the 'adprinterpipe' named pipe used for privilege escalation, and 3) the creation of new Windows services originating from the AnyDesk process chain.