RustDesk Session Permission Bypass - Unexpected Shell Child Process
Detects instances where the RustDesk remote support process (rustdesk.exe) spawns suspicious child processes such as command shells, scripting engines, or administrative utilities. This behavior is indicative of a potential session permission bypass or post-exploitation activity where an attacker leverages the context of the remote support application to execute arbitrary commands.
Sigma
