Operation Poisson: Redundant C2 via RustDesk/AnyDesk/TeamViewer + Tailscale/Havoc Correlation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•6

This rule detects potential unauthorized remote access activity by correlating the execution or network activity of known remote access tools (Tailscale) or suspicious network patterns (DuckDNS, port 4444) with the subsequent execution or network activity of secondary RAT/remote desktop software (RustDesk, AnyDesk, TeamViewer) on the same host within a 10-minute window. This behavior is indicative of an adversary establishing an initial C2 connection followed by deploying secondary remote access tools for persistent remote control.