Operation Poisson: Attacker-Deployed RustDesk Backup Remote Access (T1219)
Detects execution of the RustDesk remote access tool from non-standard, user-writable directories, or when spawned by suspicious parent processes such as shells or scripting hosts. This rule is designed to identify unauthorized use of RustDesk as a persistence or remote access mechanism by adversaries attempting to bypass standard software management.
Cortex XDR
