LoFP / some fp could occur with similar tools that uses the same command line '--set-password'

Techniques

• t1219

Sample rules

Remote Access Tool - AnyDesk Piped Password Via CLI

• source: sigma
• technicques:
  • t1219

Description

Detects piping the password to an anydesk instance via CMD and the ‘–set-password’ flag.

Detection logic

condition: selection
selection:
  CommandLine|contains|all:
  - '/c '
  - 'echo '
  - .exe --set-password