Suspicious Quest Agent Child Process

Tim Peck@timpeck

•updated Feb 2, 2026•1•0•22

Detects the Quest Desktop Authority agent service spawning suspicious child processes. This activity could be an indication of exploitation of CVE-2025-67813, where an attacker leverages the 'AdminExec' operation to achieve remote code execution as SYSTEM.