Merge PR SigmaHQ#5110 from @Neo23x0 - Update `Remote Access Tool Serv…

…ices Have Been Installed - Security`

update: Remote Access Tool Services Have Been Installed - Security - Add anydesk

rules/windows/builtin/security/win_security_service_install_remote_access_software.yml

@@ -9,7 +9,7 @@ references:
     - https://redcanary.com/blog/misbehaving-rats/
 author: Connor Martin, Nasreddine Bencherchali (Nextron Systems)
 date: 2022-12-23
-modified: 2023-11-15
+modified: 2024-12-07
 tags:
     - attack.persistence
     - attack.t1543.003
@@ -24,6 +24,7 @@ detection:
         ServiceName|contains:
             # Based on https://github.com/SigmaHQ/sigma/pull/2841
             - 'AmmyyAdmin' # https://www.ammyy.com/en/
+            - 'AnyDesk' # https://usersince99.medium.com/windows-privilege-escalation-8214ceaf4db8
             - 'Atera'
             - 'BASupportExpressSrvcUpdater' # https://www.systemlookup.com/O23/6837-BASupSrvcUpdater_exe.html
             - 'BASupportExpressStandaloneService' # https://www.systemlookup.com/O23/6839-BASupSrvc_exe.html