RustDesk Session Permission Bypass - Unauthorized Remote Control
Detects potential unauthorized remote control activity via RustDesk, specifically identifying sessions that spawn child processes (e.g., cmd.exe, powershell.exe) or exhibit behavior indicative of bypassing permission constraints on RustDesk processes not signed by the official publisher.
SentinelOne
