AnyDesk COM Printer Pipe Impersonation LPE (adprinterpipe)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•12

Detects potential privilege escalation attempts targeting AnyDesk runtime via named pipe exploitation. The rule monitors for unauthorized cross-process access to AnyDesk processes, AnyDesk spawning suspicious child processes indicative of post-exploitation activity, and the execution of a known vulnerable AnyDesk binary version.