Larva-24009 _BootUEFI_ RDP backdoor account creation and use

Duo Tech@duotech

•updated Aug 4, 2026•1•0•1

This rule detects the creation of a local user account named _BootUEFI_ and its addition to the Remote Desktop Users group, followed by RemoteInteractive logons using that account. This behavior is indicative of an RDP backdoor mechanism associated with the HeptaX campaign.