RustDesk Session Permission Bypass Activity - Comprehensive Detection
Detects evidence of RustDesk session permission bypass exploitation. The rule monitors for the presence of known Proof-of-Concept (PoC) file artifacts, suspicious child processes spawned by RustDesk, use of elevated tokens by RustDesk-initiated processes, compilation of PoC tools using cargo, and outbound network connections from RustDesk to known relay ports.
Microsoft Sentinel (KQL)
