Multiple distinct remote-access tools launched on one host after Quick Assist

ills3c Intel&Coffee@Ills3C

•updated yesterday•1•0•3

Detects the execution of Microsoft Quick Assist followed by a different remote access tool (RAT) or remote monitoring and management (RMM) utility on the same device within a 24-hour window, which may indicate adversary staging or persistence establishment.