Create proc_creation_win_remote_access_tools_anydesk_set_password_via_cli.yml

rules/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_set_password_via_cli.yml

@@ -0,0 +1,26 @@
+title: Remote Access Tool - Potential AnyDesk Set Password Via CLI
+id: b1377339-fda6-477a-b455-ac0923f9ec2c
+related:
+    - id: b1377339-fda6-477a-b455-ac0923f9ec2c
+      type: similar
+status: test
+description: Detects setting the password on an anydesk instance via CMD and the '--set-password' flag.
+references:
+    - https://redcanary.com/blog/misbehaving-rats/
+    - https://www.fox-it.com/nl-en/research-blog/the-dark-side-how-threat-actors-leverage-anydesk-for-malicious-activities/
+author: Nasreddine Bencherchali (Nextron Systems), Daniel Koifman('@KoifSec')
+date: 2024-12-25
+tags:
+    - attack.command-and-control
+    - attack.t1219
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection:
+        CommandLine|contains: '.exe --set-password'  # Example: C:\WINDOWS\system32\cmd.exe /C cmd.exe /c echo J9kzQ2Y0qO |C:\ProgramData\anydesk.exe --set-password
+    condition: selection
+falsepositives:
+    - Legitimate password setting operation on anydesk
+    - Some FP could occur with similar tools that uses the same command line '--set-password'
+level: medium