AnyDesk COM Printer Pipe Impersonation LPE (adprinterpipe)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects potential local privilege escalation (LPE) attempts targeting the AnyDesk adprinterpipe named pipe. The rule monitors for the execution of known malicious indicators, unauthorized access to the adprinterpipe, AnyDesk spawning unexpected processes as SYSTEM, and the creation of services by AnyDesk child processes.