Operation Poisson: RustDesk Abuse for Redundant Persistent Access

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•4

Detects unauthorized usage of the RustDesk remote access tool, including process execution from suspicious parents, service installation, outbound connections to known relay infrastructure, and DNS queries for RustDesk relay domains originating from non-browser processes. This rule is designed to identify secondary or redundant remote access channels potentially established by adversaries.