Anvilogic high experimental other

AnyDesk Execution from Suspicious Folder [snowflake-crowdstrikefdr_process]

Adversaries may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. This use case detects when remote access software AnyDesk is executed outside of standard install locations. -- Threat Actor Association: Alloy Taurus/Gallium, Gamaredon (aka. Armageddon, UAC-0010), Muddled Libra, Scattered Spider (aka. 0ktapus, UNC3944), Scatter Swine, UNC2659 - Software Association: Akira, ALPHV/BlackCat, AvosLocker, BianLian, BlackByte, BumbleBee, Clop, Conti, Diavol, Rhysida, Royal -- Atomics T1219 Test #2

View Source

Detection Logic

select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and event_platform = 'Win' and regexp_like(process, '.*anydesk.*', 'i') and not (regexp_like(process_path, '.*(AppData)
| (Program\\\sFiles\\\x5cAnyDesk
| (Program\\\sFiles\\\s(x86))).*', 'i'))

Field Validations

Loading…

Comments (0)

Loading comments...