Potential Process Injection Via Msra.EXE

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•42

This rule detects suspicious child processes spawned by 'msra.exe' (Microsoft Remote Assistance). Adversaries have been observed using msra.exe for process injection, discovery, and persistence. The rule specifically looks for common command-line utilities being executed as child processes of msra.exe, which could indicate malicious activity.