Batch Script Execution via AnyDesk Remote Session Leading to Sideload

Ibrahim Saud@tektrix

•updated Sep 21, 2026•1•0•3

This rule detects instances where the legitimate remote desktop application AnyDesk (AnyDesk.exe) acts as the parent process to spawn a Windows command shell (cmd.exe) or execute a batch script (.bat). This behavior is often indicative of unauthorized remote access or the execution of malicious payloads by adversaries leveraging remote support tools.