AnyDesk CVE-2026-45115 COM Printer Pipe Impersonation LPE
This rule detects potentially malicious activity associated with the exploitation of CVE-2026-45115 in AnyDesk, including the creation of the 'adprinterpipe' named pipe, the spawning of suspicious elevated child processes (e.g., cmd.exe, powershell.exe) by AnyDesk processes, or the installation of services from an AnyDesk process context.
Microsoft Sentinel (KQL)
