Enumeration

Remote-desktop tools are detected by their characteristic local listening ports and relay traffic, TeamViewer on 5938, AnyDesk on 7070, and others, and by client artefacts on a host. Identifying the product and its version selects the authentication attack and maps the client to its known product exploits.

1 min di letturaaggiornato il 5 ott 2026

1 contributore

Enumerating these tools identifies which product is present and its version, which drives configuration review and advisory matching. Endpoint evidence such as processes, services, installed files, package inventory, registry entries, and application data is authoritative. Network evidence comes from outbound connections, DNS, proxy, and firewall logs for vendor relay infrastructure. TeamViewer normally connects outward on TCP/UDP 5938 with fallbacks to TCP 443 or 80; AnyDesk uses outbound TCP 80, 443, or 6568 and UDP 50001–50003 for local discovery. These destination ports are not general inbound service fingerprints.

bash

# on a host: identify the client and version from processes/installed files
tasklist | findstr /i 'teamviewer anydesk splashtop'    # Windows
# from network telemetry, correlate destinations and process identity rather than scanning ports

Subtopics#

Service detection: identifying the product by port and traffic.
Version detection: determining the client version.

Enumeration

Subtopics#

References#