RustDesk Installed as Persistent Windows Service (Akira Intrusion Chain)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects the installation of the RustDesk remote access software as a Windows system service. This is identified by monitoring Event ID 7045 (Service Installation) for service names or image paths associated with RustDesk.