Remote Access Tool - AnyDesk Execution With Known Revoked Signing Certificate

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Sai Prashanth Pulisetti, Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the execution of an AnyDesk binary with a version prior to 8.0.8. Prior to version 8.0.8, the Anydesk application used a signing certificate that got compromised by threat actors. Use this rule to detect instances of older versions of Anydesk using the compromised certificate This is recommended in order to avoid attackers leveraging the certificate and signing their binaries to bypass detections.

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	No specific technique
Execution	No specific technique

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Remote Access Tool - AnyDesk Execution With Known Revoked Signing Certificate
id: 41f407b5-3096-44ea-a74f-96d04fbc41be
status: test
description: |
    Detects the execution of an AnyDesk binary with a version prior to 8.0.8.
    Prior to version 8.0.8, the Anydesk application used a signing certificate that got compromised by threat actors.
    Use this rule to detect instances of older versions of Anydesk using the compromised certificate
    This is recommended in order to avoid attackers leveraging the certificate and signing their binaries to bypass detections.
references:
    - https://www.bleepingcomputer.com/news/security/anydesk-says-hackers-breached-its-production-servers-reset-passwords/
    - https://anydesk.com/en/changelog/windows
author: Sai Prashanth Pulisetti, Nasreddine Bencherchali (Nextron Systems)
date: 2024-02-08
tags:
    - attack.execution
    - attack.initial-access
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\AnyDesk.exe'
        - Description: 'AnyDesk'
        - Product: 'AnyDesk'
        - Company: 'AnyDesk Software GmbH'
    selection_version:
        FileVersion|startswith:
            - '7.0.'
            - '7.1.'
            - '8.0.1'
            - '8.0.2'
            - '8.0.3'
            - '8.0.4'
            - '8.0.5'
            - '8.0.6'
            - '8.0.7'
    filter_main_uninstall:
        CommandLine|contains:
            - ' --remove'
            - ' --uninstall'
    condition: all of selection_* and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_* and not 1 of filter_main_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\AnyDesk.exe'
    - Description: 'AnyDesk'
    - Product: 'AnyDesk'
    - Company: 'AnyDesk Software GmbH'

Stage 2: `selection_version`

selection_version:
    FileVersion|startswith:
        - '7.0.'
        - '7.1.'
        - '8.0.1'
        - '8.0.2'
        - '8.0.3'
        - '8.0.4'
        - '8.0.5'
        - '8.0.6'
        - '8.0.7'

Stage 3: `not filter_main_uninstall`

filter_main_uninstall:
    CommandLine|contains:
        - ' --remove'
        - ' --uninstall'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`CommandLine`	match	`--remove`	`excludes:CommandLine` `field:"CommandLine" value:" --remove"`
`CommandLine`	match	`--uninstall`	`excludes:CommandLine` `field:"CommandLine" value:" --uninstall"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Company`	eq	`AnyDesk Software GmbH` corpus 3 (sigma 3)	`field:"Company" kind:eq value:"AnyDesk Software GmbH"`
`Description`	eq	`AnyDesk` corpus 3 (sigma 3)	`field:"Description" kind:eq value:"AnyDesk"`
`FileVersion`	starts_with	`7.0.` `7.1.` `8.0.1` `8.0.2` `8.0.3` `8.0.4` `8.0.5` `8.0.6` `8.0.7`	`field:"FileVersion" kind:starts_with`
`Image`	ends_with	`\AnyDesk.exe` corpus 5 (sigma 5)	`field:"Image" kind:ends_with value:"\AnyDesk.exe"`
`Product`	eq	`AnyDesk` corpus 3 (sigma 3)	`field:"Product" kind:eq value:"AnyDesk"`