RustDesk FileTransfer Session Sending Non-FileTransfer Message Types (Permission Bypass)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule monitors for the execution of the RustDesk remote access tool and specifically tracks any child processes spawned by it. Detecting child processes spawned by legitimate remote access tools like RustDesk is a high-fidelity signal for identifying post-compromise activity, such as command execution or lateral movement.