AnyDesk executable running from non-standard user-writable path
Detects the execution of anydesk.exe from user-writable directories such as AppData, Temp, Downloads, or Music. This behavior is indicative of potential unauthorized use of remote access software, which may be deployed by an adversary for persistence or establishing a command and control channel outside of standard administrative tools.
Microsoft Sentinel (KQL)
