AnyDesk Silent Install with Start-with-Windows Persistence

This rule detects the silent installation of AnyDesk with persistence enabled via the '--start-with-win' flag. This behavior is indicative of unauthorized remote access tool deployment, often used for establishing persistent command and control.