Google Quick Share Spawning System Shell - Possible Exploitation

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

Detects instances where Windows Nearby Sharing related processes (quick_share.exe, NearbyShare.exe, nearby_sharing.exe) spawn command-line interpreters (cmd.exe, powershell.exe). This pattern is anomalous as these utilities are intended for file transfer, not command execution, and could indicate exploitation of these applications to achieve code execution.