Quick Assist Spawning Discovery Commands
Identifies QuickAssist.exe launching cmd.exe to perform network and domain discovery commands. This behavior is indicative of post-exploitation reconnaissance following a remote support session, commonly seen in Nimbus RAT campaigns.
Microsoft Sentinel (KQL)
