The results are used to automating their detection during our investigations in order to speed up the process and spot interesting log files. Therefore, based on IcsNick's comprehensive list and other public investigation reports, we decided to analyse a few of them - as a starter - in order to fully understand what artefacts are generated from these tools. between an IT provider and its customers). Indeed, threat actors leverage these legitimate tools to perform several actions: obtaining remote access on the device and a persistence, pushing scripts and other tools, as well as performing lateral movement towards other devices of linked corporate information systems (e.g. The motivation to do this study came from a tweet made by listing 'Remote Admin Tools that are abused by threat actors' 1. Tools that do not allow a visual interaction such as PsExec are not included in this study. A third-party remote access tool allows people not physically in contact with a device to control, interact with it, and see its screen.

Stand by your computer and watch what we are doing, we may have some questions for you.The purpose of this article is to detail the artefacts left by a third-party remote access tool during its setup and use. Only give access to your computer to people you know and trust. We will then request access to your computer which you must accept. Open AnyDesk and supply us with your address which you can find on the left hand side of the screen. When it is finished, you should now be able to find AnyDesk in your start menu. For the most part, you can keep the default settings and then click the green 'Accept & Install' button. Click the green 'yes' button.Īfter clicking 'yes', the installer will start. Now close the program and AnyDesk will ask you if you want to install it. AnyDesk can run without being installed, but it's best to install it so that you can easily find it in your start menu.

When you double click on the 'AnyDesk.exe' file the program will run automatically. By default, this will be in your 'Downloads' folder. Click 'Save File' and while it is downloading, take your time to look at the 'getting started in 3 easy steps.' When you are ready, click the 'Download' button.Ī popup will appear asking your to save the file.

The website should automatically detect that you're using Windows.

Anydesk windows startup