Technique ID | Title | Link |
---|---|---|
T1219 | Remote Access Software | https://attack.mitre.org/techniques/T1219/ |
List devices from which AnyDesk makes a remote connection.
DeviceNetworkEvents
| where InitiatingProcessFileName == "AnyDesk.exe"
| where LocalIPType == "Private"
| where RemoteIPType == "Public"
| where RemoteUrl != "boot.net.anydesk.com" // Initial AnyDesk Connection when booted.
| project
Timestamp,
DeviceId,
InitiatingProcessAccountName,
ActionType,
RemoteIP,
RemotePort,
RemoteUrl
DeviceNetworkEvents
| where InitiatingProcessFileName == "AnyDesk.exe"
| where LocalIPType == "Private"
| where RemoteIPType == "Public"
| where RemoteUrl != "boot.net.anydesk.com" // Initial AnyDesk Connection when booted.
| project
TimeGenerated,
DeviceId,
InitiatingProcessAccountName,
ActionType,
RemoteIP,
RemotePort,
RemoteUrl