Email bombing followed by Remote Assistance session launch

Ankit Mehta@Secvyn

•updated Sep 26, 2026•6•0•20

Detects a sequence of activity where a user receives a high volume of inbound emails (potential vishing or social engineering lures) within a short window, followed by the user executing Windows Remote Assistance or Quick Assist tools within the next 6 hours, which is highly indicative of remote access social engineering pre-cursors.