MSI installer launched by Quick Assist or AnyDesk remote-access process

Ibrahim Saud@tektrix

•updated Sep 26, 2026•1•0•5

Detects the Windows Installer service (msiexec.exe) being launched by known remote access software processes like msra.exe (Microsoft Remote Assistance) or anydesk.exe. This behavior is often associated with unauthorized software installation or payload delivery via remote support tools.