Remote Management and Monitoring tool - AnyDesk - Create Process

Hunt Hypothesis

The detection identifies the use of AnyDesk, a remote management tool, to create processes that may indicate adversary persistence or command and control activity. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential compromise of endpoints managed by RMM tools.

KQL Query

let Time_start = now(-5d);
let Time_end = now();
//
DeviceProcessEvents 
| where Timestamp between (Time_start..Time_end)
| where ProcessVersionInfoCompanyName has_any ('anydesk software', 'philandro software')
    and ProcessVersionInfoProductName has 'anydesk'
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), 
    Report=make_set(ReportId), Count=count() by DeviceId, DeviceName

Analytic Rule Definition

id: e9c26766-0fe4-49b6-ae27-c41c41aae094
name: Remote Management and Monitoring tool - AnyDesk - Create Process
description: |
    Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
    https://github.com/jischell-msft/RemoteManagementMonitoringTools
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics: CommandAndControl
relevantTechniques: T1219
query: |
  let Time_start = now(-5d);
  let Time_end = now();
  //
  DeviceProcessEvents 
  | where Timestamp between (Time_start..Time_end)
  | where ProcessVersionInfoCompanyName has_any ('anydesk software', 'philandro software')
      and ProcessVersionInfoProductName has 'anydesk'
  | summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), 
      Report=make_set(ReportId), Count=count() by DeviceId, DeviceName

Required Data Sources

MITRE ATT&CK Context

• Tactic: CommandAndControl
• Technique: T1219 — T1219

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/RemoteManagementMonitoring/rmm_AnyDesk_createproc.yaml)

False Positive Guidance

• Scenario: IT Admin Deploys AnyDesk for Remote Support
  Description: A system administrator uses AnyDesk to remotely support end-users, which is a legitimate use case.
  Filter/Exclusion: process.name != "AnyDesk" OR process.parent.name == "Remote Desktop Services" OR user.account == "IT_Admin_Account"

• Scenario: Scheduled AnyDesk Job for System Maintenance
  Description: A scheduled task runs AnyDesk to perform routine maintenance or updates on endpoints.
  Filter/Exclusion: process.name == "AnyDesk" AND process.parent.name == "Task Scheduler" OR process.command_line contains "maintenance"

• Scenario: AnyDesk Used for Remote PowerShell Execution
  Description: An IT admin uses AnyDesk to establish a remote session and execute PowerShell scripts for patching or configuration.
  Filter/Exclusion: process.name == "AnyDesk" AND process.parent.name == "Windows PowerShell" OR process.command_line contains "powershell"

• Scenario: AnyDesk Installed via Group Policy for Endpoint Management
  Description: AnyDesk is deployed via Group Policy to manage and monitor endpoints across the enterprise.
  Filter/Exclusion: process.name == "AnyDesk" AND process.parent.name == "Group Policy Client" OR process.command_line contains "gpupdate"

• Scenario: AnyDesk Used for Remote Monitoring of Network Devices
  Description: A network admin uses AnyDesk to monitor and manage network devices such as routers or switches.
  Filter/Exclusion: process.name == "AnyDesk" AND process.parent.name == "Network Management Service" OR process.command_line contains "monitor"