TA4922 AnyDesk or SyncFuture RMM Spawned from Suspicious Parent Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•3

Detects the execution of remote monitoring and management (RMM) binaries AnyDesk or SyncFuture when launched by suspicious parent processes commonly associated with phishing delivery chains (e.g., mshta, wscript, cmd, powershell), or when executed from user-writable directories like Temp or AppData, which is a common pattern for persistent remote access abuse.