AnyDesk Printer COM Impersonation LPE - Unexpected Child Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects AnyDesk spawning suspicious child processes (cmd, powershell, etc.) indicative of local privilege escalation via the AnyDesk printer COM object impersonation vulnerability. This technique involves an attacker-controlled process communicating with the AnyDesk service's named pipe (adprinterpipe) to trigger code execution in the context of the LocalSystem AnyDesk service.