Payouts King: Quick Assist Launch Preceded by Microsoft Teams Activity

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•3

This rule detects the execution of Quick Assist (quickassist.exe) or Microsoft Remote Assistance (msra.exe) in scenarios where the parent process, causality chain, or command line includes references to Microsoft Teams. This behavior is indicative of social engineering attempts where attackers impersonate IT support via Teams to induce users to launch remote access tools, a tactic observed in campaigns like BlackBasta.