AnyDesk persistence via sc create service and forced reboot
Detects the creation of a new Windows service where the service binPath points to 'anydesk.exe', optionally accompanied by a system reboot command within one hour of the service creation. This behavior is often associated with the installation or persistent configuration of remote access software.
Microsoft Sentinel (KQL)
