Library / RMM
anydesk.exe
AnyDesk · AnyDesk Software GmbH
OriginalFilename
None. No observed build carries an OriginalFilename, so sensors log -.
LOLRMM value disagreesNo OriginalFilename
Gotchas
AnyDesk 9.8.2 has a version resource (description, company, product) but no OriginalFilename key; Sysmon logs -. LOLRMM's PEMetadata lists AnyDesk.exe, which current builds don't carry. Key on the signer (AnyDesk Software GmbH) or the image path instead.
- No OriginalFilename in any observed build, so Sysmon logs
-and OriginalFileName rules can't match it. Anchor on the image path, hash or signer instead. - LOLRMM lists
AnyDesk.exefor AnyDesk; parsed builds show none.
Query snippets
# No OriginalFilename in any observed build: match on the image instead
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: '\anydesk.exe'
condition: selectionprocess_creation logsource. Sigma string matching is case-insensitive.
| tstats summariesonly=false count from datamodel=Endpoint.Processes
where Processes.process_name="anydesk.exe"
by Processes.dest Processes.process_name Processes.process_path Processes.process
| rename Processes.* as *Endpoint.Processes data model. On raw Sysmon events the field is OriginalFileName.
DeviceProcessEvents
| where FileName =~ "anydesk.exe"Microsoft Defender XDR advanced hunting. in~ and =~ are case-insensitive.
process where event.type == "start" and process.name : "anydesk.exe"ECS process.pe.original_file_name is a keyword field: in~ is case-insensitive, Kibana KQL is not.
String(Image || '').toLowerCase().endsWith("\\anydesk.exe")Filter expression (JavaScript) for events carrying Sysmon's OriginalFileName field.
Values across builds
| OriginalFilename | Builds | Arch | File version | Windows releases | Source | Sysmon |
|---|---|---|---|---|---|---|
| none | 1 | x86 | 9.8.2.0 | Vendor | ✓ 1 |
All 1 parsed builds
| SHA256 | Version | Arch | OriginalFilename | Windows releases | Signature | Source | Sysmon |
|---|---|---|---|---|---|---|---|
| 2a85e3bc09a2… | 9.8.2.0 | x86 | none | AnyDesk | Vendor | ✓ |
Winbindex builds link to the Microsoft symbol server copy that was hashed and parsed.