Payouts King - Quick Assist Social Engineering Initial Access Chain

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects Payouts King ransomware operator TTPs involving Microsoft Teams social engineering followed by Windows Quick Assist (msra.exe) abuse. The rule monitors for three primary indicators: Teams spawning Quick Assist, Quick Assist being launched with remote session-initiation flags, and Quick Assist spawning suspicious child processes (cmd, powershell, etc.) or network utilities (curl, certutil, bitsadmin) characteristic of post-exploitation payload delivery.