AnyDesk registered for Safe Mode with Networking via reg.exe after local account

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•2•0•4

Detects a sequence where a local user account is created or added to a local group using net.exe or net1.exe, followed by reg.exe configuring AnyDesk persistence under the SafeBoot Network registry key on the same device within a 24-hour window.