RustDesk Remote Access Tool Registered as Windows Service

Ankit Mehta@Secvyn

•updated Jun 30, 2026•1•0•1

Detects the creation or modification of Windows Registry keys or values within the 'CurrentControlSet\Services' path that refer to 'rustdesk'. This typically indicates the installation or configuration of the RustDesk remote access tool as a system service, which may be unauthorized or used for persistence by an adversary.