CVE-2026-46331 RustDesk Session Permission Bypass — Unauthorized Control
Detects indicators of potential exploitation of CVE-2026-46331 in RustDesk, which involves a session permission bypass. The rule identifies suspicious post-exploitation behavior, specifically when rustdesk.exe spawns common command-line or reconnaissance utilities, and when it initiates outbound network connections on non-standard relay ports.
Microsoft Sentinel (KQL)
