Payouts King: Quick Assist Session After Teams Contact - Spam Bombing Initial Access
This rule detects the execution of Microsoft Quick Assist (msra.exe or quickassist.exe) on endpoints. It elevates the risk score if the event is preceded by Microsoft Teams activity within 30 minutes or occurs on a host exhibiting high volumes of email traffic, which may indicate remote access tool abuse following a social engineering or phishing attempt.
Splunk (SPL)
