AnyDesk Printer COM Impersonation LPE — Elevated Child Process or dllhost Spawn

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects instances where the AnyDesk remote support application spawns suspicious child processes or administrative utilities. This rule specifically alerts on AnyDesk launching interpreters such as PowerShell, CMD, WScript, or utility binaries like dllhost, regsvr32, mshta, and rundll32, or when processes are executed in the context of the SYSTEM account (UserSid S-1-5-18). Such behavior is a common indicator of unauthorized remote access or post-exploitation activity.