Payouts King: Quick Assist Abuse - Child Process Spawned or Teams Launch Chain

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects execution of Windows remote assistance tools like Quick Assist, msrdcw, or msra when spawned by unexpected parent processes, or when spawned by Microsoft Teams. This behavior may indicate an adversary abusing legitimate remote access software to maintain persistence, conduct lateral movement, or gain interactive access to a compromised system.