Silent AnyDesk Install from Non-Standard Path (SnakeBiteAgent)
Detects execution of AnyDesk from non-standard directories such as Temp, AppData, or User profile folders, often indicative of unauthorized or portable installation of remote access software.
Microsoft Sentinel (KQL)

