Operation Poisson RustDesk Abuse for Covert Remote Access
This rule detects various activities associated with the RustDesk remote access tool, including process execution, file staging (RustCustom.zip or rustdesk.exe by hash), firewall rule creation for RustDesk, and service installation related to RustDesk. Detection is based on process names, file names, SHA256 hashes, firewall rule names, and service names.
Microsoft Sentinel (KQL)
