RustDesk Deployed as Redundant Remote Access Channel (Operation Poisson)
Detects the presence and execution of RustDesk remote access software by monitoring process names, command-line arguments, specific destination network ports, and DNS queries associated with the application. This rule identifies potential unauthorized remote access attempts or the use of non-approved remote support tools.
Splunk (SPL)
