RustDesk Session Permission Bypass — Forged Relay or Downgraded Session (CVE-2026-46331)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

This rule detects potentially malicious activity associated with the RustDesk remote access tool. It monitors for two conditions: 1) RustDesk spawning suspicious child processes (e.g., shells, scripting engines, or network tools) that indicate post-exploitation behavior. 2) The RustDesk binary being executed from an unusual parent process, which may indicate session hijacking or unauthorized installation.