RustDesk Permission Bypass - Unauthorized Session on RustDesk Relay Ports

Ethan Andrews@eandrews

•updated Jun 28, 2026•1•0•3

This rule detects outbound network connections made by the RustDesk process to non-corporate relay server IP addresses on the default RustDesk relay ports (21115, 21116, 21117). This behavior may indicate an unauthorized remote control session establishment, bypassing expected organizational proxy or relay controls.