T1068: AnyPwn CVE-2025-27918 AnyDesk Linux Service Spawning Shell Child as Root

Tim Peck@timpeck

•updated 8 days ago•1•0•9

Detects the AnyDesk Linux service running as root spawning a shell process (sh, bash, dash, zsh) or executing a command associated with the AnyPwn (CVE-2025-27918) post-exploitation behavior.