RustDesk Installed as Auto-Start Windows Service (T1219/T1543.003)

Duo Tech@duotech

•updated Jun 29, 2026•0•0•1

Detects the installation of RustDesk as a Windows service, identified via System event log ID 7045. Adversaries may abuse this remote access tool to maintain persistent, unauthorized remote access to compromised systems, as observed in ransomware intrusions.