RustDesk unauthorized session takeover: new peer, shell spawn, suspicious file write

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects potentially unauthorized or suspicious usage of the RustDesk remote access tool. The rule monitors for connections from new peer IDs, the spawning of command shells (cmd.exe or powershell.exe) by the RustDesk process, and the writing of executable or sensitive file types by RustDesk to non-standard directories.