AnyDesk adprinterpipe Named Pipe Creation for COM Impersonation LPE

Ibrahim Saud@tektrix

•updated Jun 30, 2026•8•0•25

Detects potential local privilege escalation attempts leveraging the AnyDesk printer named pipe (adprinterpipe). The rule monitors for the creation of the adprinterpipe, the spawning of processes with SYSTEM privileges from an AnyDesk parent, and the loading of suspicious DLLs by AnyDesk, which are indicative of an exploit leveraging insecure COM unmarshaling callbacks.