RustDesk Session Permission Bypass - Anomalous Relay Connection on Ports 21115-21117

Ethan Andrews@eandrews

•updated Jun 28, 2026•0•0•1

Detects network flows to RustDesk relay server ports (21115, 21116, 21117) characterized by anomalous connection patterns. The rule identifies hosts exhibiting rapid, repeated connection attempts or connections to multiple distinct relay IP addresses within a short timeframe. This behavior is consistent with the 'rustdesk-session-permission-pocs' technique, which may indicate an attacker attempting to establish a remote session while bypassing the standard permission handshake exchange required by the application.