Remote Access Tool -AnyDesk Execution With Known Revoked Signing Certificate

Introduction

In the world of cybersecurity, contributions come in various forms. One such contribution is the creation of rules that enhance the security of applications. This blog post discusses a pull request made to SigmaHQ that added a new rule to detect the execution of the AnyDesk application signed with a known compromised certificate.

The Importance of the Rule

The importance of this rule is underscored by a recent security incident involving AnyDesk. A security audit revealed evidence …

anydesk cyber security awareness information security security-operation-center threat hunting