Payouts King Valid Account Abuse for Privilege Escalation Post-Social Engineering
Detects privilege escalation events (assigning special privileges or executing privileged operations) occurring on a host shortly after the execution of legitimate remote support tools such as Quick Assist or msra.exe. This pattern is consistent with social engineering campaigns where attackers gain remote access via support tools and then perform local privilege escalation.
Microsoft Sentinel (KQL)
