Detect Suspicious RustDesk Remote Access Software Installation

Daniel Jeremiah@daniyyell

•updated Jul 6, 2026•8•0•9

Detects unauthorized installation, service creation, and registry modifications associated with the RustDesk remote access tool. The rule monitors for command-line activity indicating the installation of RustDesk as a service, execution of installation scripts, and imports of configurations from non-standard locations, which may indicate the deployment of unauthorized remote access software for C2 purposes.