Quick Share Service Spawning Unexpected Child Process

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•0

This rule detects instances where Windows file sharing-related processes, specifically NearShareReceive.exe, QuickShare.exe, or nearshare.exe, spawn command-line or scripting interpreters such as cmd.exe, powershell.exe, wscript.exe, cscript.exe, or mshta.exe. This activity is indicative of potential malicious file execution where an adversary leverages built-in sharing features to deliver and execute payloads.