STAC4749 Remote Access Tool Execution (Quick Assist, RemSupp, DWAgent, AnyDesk)

Duo Tech@duotech

•updated Jul 31, 2026•7•0•16

Detects execution of remote access/RMM tools (Microsoft Quick Assist, RemSupp, DWAgent, AnyDesk) observed used by STAC4749 for initial access and backup remote-access channels following Teams vishing contact.