Quick Assist launched shortly after Microsoft Teams sign-in activity (vishing follow-up)
Detects Quick Assist (msra.exe/quickassist.exe) being launched on a device within a short window after the same user signed into Microsoft Teams, consistent with UNC6692's vishing tradecraft where actors impersonate internal IT support over Teams and coerce victims into granting remote access via Quick Assist to deploy the Edgecution malware suite.
Microsoft Sentinel (KQL)
