Potential Process Injection Via Msra.EXE

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics