Anvilogic high experimental other

AnyDesk Command Line Execution [snowflake-crowdstrikefdr_process]

For most users, normal AnyDesk activity is executed via the GUI. This use case detects anydesk.exe calls from cmd.exe or PowerShell.exe. Install commands have been filtered out by default. - Threat Actor Association: Alloy Taurus/Gallium, Gamaredon (aka. Armageddon, UAC-0010), Muddled Libra, Scattered Spider (aka. 0ktapus, UNC3944), Scatter Swine, UNC2659 - Software Association: Akira, ALPHV/BlackCat, AvosLocker, BianLian, BlackByte, BumbleBee, Clop, Conti, Diavol, Rhysida, Royal

View Source

Detection Logic

select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and event_platform = 'Win' and (regexp_like(process, '.*(anydesk.exe).*', 'i') and not regexp_like(process, '.*install.*', 'i'))

Field Validations

Loading…

Comments (0)

Loading comments...