anydesk.logs

$ target-query <path/to/target> -f anydesk.logs

Details

Module	apps.remoteaccess.anydesk.AnydeskPlugin
Output	records

Module documentation

Anydesk plugin.

Function documentation

Return the content of the AnyDesk logs.

AnyDesk is a remote desktop application and can be used by adversaries to get (persistent) access to a machine. Log files (.trace files) are retrieved from various location based on OS and client type.

References:

• https://www.inversecos.com/2021/02/forensic-analysis-of-anydesk-logs.html

• https://support.anydesk.com/knowledge/trace-files#trace-file-locations