RustDesk installed and registered as a persistent Windows service
Detects the installation or creation of a Windows service related to RustDesk, a remote access software application. This may indicate unauthorized installation or persistence setup of remote control tools by an adversary.
Microsoft Sentinel (KQL)

