Payouts King: Spam Bomb then Teams IT Impersonation with Quick Assist
Detects a multi-stage attack pattern involving a 'spam bomb' (high volume of inbound emails) followed by an external Microsoft Teams message and the subsequent execution of Windows Quick Assist (quickassist.exe or msra.exe) on the target endpoint. This behavior is highly indicative of a tech support scam or social engineering attack where an adversary floods a user's inbox to create urgency, contacts them via Teams, and convinces them to initiate a remote support session.
Microsoft Sentinel (KQL)
