RustDesk Session Permission Bypass — Screen Capture and Input Injection
Detects potentially unauthorized or malicious behavior associated with the RustDesk remote access tool. The rule monitors for unsigned screen capture attempts, spawning of shell or scripting processes, cross-process input injection, and network communication over non-standard or unexpected ports.
SentinelOne
