AnyDesk Silent Install (Sysmon)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. BlackByte ransomware group has been observed performing silent installs of AnyDesk after establishing a foothold. This use case detects silent installation of AnyDesk

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1219` Remote Access Tools

References

https://blog.talosintelligence.com/2022/05/the-blackbyte-ransomware-group-is.html

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

id: '13728.20153'
title: AnyDesk Silent Install
description: 'An adversary may use legitimate desktop support and remote access software
  to establish an interactive command and control channel to target systems within
  networks. BlackByte ransomware group has been observed performing silent installs
  of AnyDesk after establishing a foothold. This use case detects silent installation
  of AnyDesk. - Threat Actor Association: Alloy Taurus/Gallium, Gamaredon (aka. Armageddon,
  UAC-0010), Muddled Libra, Scattered Spider (aka. 0ktapus, UNC3944), Scatter Swine,
  UNC2659 - Software Association: Akira, ALPHV/BlackCat, AvosLocker, BianLian, BlackByte,
  BumbleBee, Clop, Conti, Diavol, Royal'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  TERM(AnyDesk) "--silent" | regex process="(?i)(anydesk.exe).*(--silent)" | table
  _time, host, user, process, process_* | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- command-and-control:remote access software
technique_id: 
- T1219
data_category:
- Windows Sysmon
- Process command-line parameters
references:
- https://blog.talosintelligence.com/2022/05/the-blackbyte-ransomware-group-is.html

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<") TERM(AnyDesk) "--silent"

Stage 2: `regex`

| regex process="(?i)(anydesk.exe).*(--silent)"

Stage 3: `table`

| table _time, host, user, process, process_*

Stage 4: `bucket`

| bin span=1s

Stage 5: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`1` corpus 241 (splunk 225, kusto 15, elastic 1)	`field:"EventID" kind:eq value:"1"`
`process`	regex_match	`"(?i)(anydesk.exe).*(--silent)"` corpus 2 (splunk 2)	`field:"CommandLine" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>1<"`
1	`AnyDesk`
1	`"--silent"`