Posted on

AnyDesk Linux AnyPwn Pre-Auth RCE — Sentinel Hunts

Threat Overview

On 8 October 2026, researchers at V12 published a working proof-of-concept (PoC) exploit for an AnyDesk Linux session-protocol heap buffer overflow dubbed AnyPwn; The Hacker News reported it on 9 October. The demonstrated path uses a direct TCP connection to port 7070 and can execute a command as root before a remote-control session is approved. The PoC is tuned for Linux AnyDesk 8.0.2, with probabilistic exploitation: failed attempts may crash the service. AnyDesk fixed the issue in 8.0.3 on 23 June 2026, without a CVE or formal security advisory. The researchers say the vulnerable code path is reachable through relays but have not shown the full exploit there; the vendor limits its confirmed exposure statement to direct Linux connections. There is no verified in-the-wild exploitation report in the cited sources. Hunt for exposure, service crashes, suspicious children and unexpected outbound behavior, not a claimed unique exploit signature.

References

Impacted Systems

  • Vendor/product: AnyDesk remote-desktop software, Linux self-managed hosts/endpoints running the AnyDesk service; confirmed vulnerable build 8.0.2. Earlier builds including 8.0.1 are suspected by researchers but have not been individually demonstrated.
  • Attacker prerequisite: direct network access to the AnyDesk session service on TCP/7070. Exploit is pre-authorization and can inherit the root privilege of the service. Internet exposure is not required if an attacker has internal network reachability.
  • Fixed: AnyDesk Linux 8.0.3 and later (vendor changelog, June 23); latest listed 8.1.0 (September 23). Windows and macOS are explicitly unaffected by this issue per vendor.
  • Relay-path full exploitation remains unconfirmed; there is no CVE assignment as of the October 9 reporting.

Why this matters

Remote-support tools may be deployed broadly, and the flaw is not discoverable by CVE-based patch prioritization. A publicly released working PoC increases opportunistic abuse risk on exposed Linux hosts.

Exploitation Status

Confirmed: working public exploit demonstrated on AnyDesk Linux 8.0.2 via direct TCP/7070; fixed in 8.0.3. Vendor statement: Windows/macOS unaffected; issue scoped to direct Linux connections. Unconfirmed: exploitation in the wild, full relay exploitation, exploitability of earlier Linux builds.

What this hunt looks for

Prepared Sentinel queries for AnyDesk execution, port 7070 traffic, repeated inbound connections, crash/restart behavior, shell child processes, new outbound destinations, and Linux persistence signals. No customer workspace was queried.

Required logs

Microsoft Sentinel tables, where ingested: CommonSecurityLog, DeviceNetworkEvents, DeviceProcessEvents, Syslog. Query results depend on appropriate collection, schema and retention.

1. First pass — AnyDesk Linux execution on endpoints

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FolderPath startswith "/"
| where FileName =~ "anydesk" or ProcessCommandLine has "anydesk"
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, SHA256
| order by TimeGenerated desc

2. AnyDesk direct transport — endpoint TCP 7070

DeviceNetworkEvents
| where TimeGenerated >= ago(14d)
| where LocalPort == 7070 or RemotePort == 7070
| where InitiatingProcessFileName =~ "anydesk" or InitiatingProcessCommandLine has "anydesk" or LocalPort == 7070
| summarize Connections=count(), RemoteIPs=dcount(RemoteIP), SampleIPs=make_set(RemoteIP,12), Actions=make_set(ActionType,6) by DeviceName, LocalPort, RemotePort, InitiatingProcessFileName, bin(TimeGenerated,1h)
| order by Connections desc

3. Inbound firewall traffic targeting direct AnyDesk TCP 7070

CommonSecurityLog
| where TimeGenerated >= ago(14d)
| where DestinationPort == 7070 and Protocol has "TCP"
| summarize Attempts=count(), Sources=dcount(SourceIP), SourceIPs=make_set(SourceIP,12), Actions=make_set(DeviceAction,8) by DestinationIP, bin(TimeGenerated,1h)
| where Attempts >= 5
| order by Attempts desc

4. Linux AnyDesk service crashes and restart indicators

Syslog
| where TimeGenerated >= ago(14d)
| where SyslogMessage has "anydesk"
| where SyslogMessage has_any ("crash","segfault","core dump","killed","failed","restart","signal","aborted")
| project TimeGenerated, Computer, ProcessName, SeverityLevel, SyslogMessage
| order by TimeGenerated desc

5. AnyDesk process spawning unexpected shells or download tools

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName =~ "anydesk"
| where FileName in~ ("sh","bash","dash","zsh","python","python3","curl","wget","nc","ncat","socat")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath
| order by TimeGenerated desc

6. New external destinations from AnyDesk process

let Baseline=DeviceNetworkEvents
| where TimeGenerated between (ago(30d) .. ago(3d))
| where InitiatingProcessFileName =~ "anydesk" and isnotempty(RemoteIP)
| summarize by DeviceId, RemoteIP;
DeviceNetworkEvents
| where TimeGenerated >= ago(3d)
| where InitiatingProcessFileName =~ "anydesk" and isnotempty(RemoteIP)
| join kind=leftanti Baseline on DeviceId, RemoteIP
| project TimeGenerated, DeviceName, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType
| order by TimeGenerated desc

7. Repeated firewall connection attempts against one AnyDesk host

CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where DestinationPort == 7070
| summarize Attempts=count(), SourceIPs=dcount(SourceIP), SampleSources=make_set(SourceIP,10), Denied=countif(DeviceAction has_any ("deny","drop","block")) by DestinationIP, bin(TimeGenerated,15m)
| where Attempts >= 30 or SourceIPs >= 5
| order by Attempts desc

8. Linux persistence or privileged execution near AnyDesk events

Syslog
| where TimeGenerated >= ago(14d)
| where SyslogMessage has_any ("anydesk","crontab","systemctl","sudo","su:")
| where SyslogMessage has "anydesk" or (ProcessName in~ ("sudo","cron","systemd") and SyslogMessage has_any ("new service","Created symlink","root","crontab"))
| project TimeGenerated, Computer, ProcessName, SeverityLevel, SyslogMessage
| order by TimeGenerated desc

Detection Notes

  • Highest signal: externally reachable TCP/7070 to a confirmed AnyDesk Linux 8.0.2 host plus unexpected AnyDesk service crashes or a shell child process. Correlation requires reliable host identity.
  • AnyDesk legitimately makes outbound remote-control connections. Port 7070 can be used by unrelated applications; scope by known Linux AnyDesk hosts and process where possible.
  • Linux Syslog rarely captures full execve command lines or network payloads; `DeviceProcessEvents`/`DeviceNetworkEvents` require onboarded Linux endpoints and Sentinel-accessible Defender tables.
  • A crash is not proof of exploitation. Public PoC release is confirmed, but no known exploitation in the wild is asserted.
  • No packet signature or exploit bytes are asserted; encrypted relay traffic cannot be inspected with these queries.

Leave a Reply