Recently saw an interesting feature in a third party security application (and i wish implements in my own app) that was ability able to detect any remote access tool without any code injection + api hook on remote processes for example. This application creates a virtual desktop and all UI works from it:
The detection happens when exists a connection (local or remote) + a thread inside virtual desktop (via SetThreadDesktop) of security application. If exists only the connection or thread alones, does not detect.
Someone have some idea how they succeed it with this accuracy? Thanks by any consistent suggestion.