AnyDesk COM Printer Driver Impersonation LPE via adprinterpipe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects potentially malicious activity involving the AnyDesk remote access tool by monitoring for abnormal child process spawning, such as command shells (cmd, powershell, etc.), and suspicious DLL loading behavior from non-standard directories. These activities are common indicators of an adversary using remote desktop software for command and control or post-exploitation execution.