Quick Assist or Terminal Services remote session followed by RMM or exfil tool

ills3c Intel&Coffee@Ills3C

•updated yesterday•1•0•1

Detects the execution of Quick Assist or Remote Desktop (mstsc.exe) followed within a 2-hour window by administrative/remote support or exfiltration tooling such as AnyDesk, Bomgar, Zoho, SuperOps, WinSCP, or rclone on the same device.