T1219 Remote Access Tools
3 threats tracked by Spectrum Delta use this technique.
Teams external-chat IT scam
RMM tool execution: victim account launches Quick Assist or installs a commercial RMM under attacker direction
Windows process execution: quickassist.exe or msra.exe launched under the victim's user account shortly after an external Teams chat/call; process execution of AnyDesk/Atera/ScreenConnect/TeamViewer/Zoho Assist/NetSupport/LogMeIn; msiexec.exe install specifically documented for Level; alert on RMM tools not sanctioned or expected in the environment; correlate with concurrent Teams activity for the same user
Seen in: Windows process execution
Amazon ClickFix (Doina)
Pirated NetSupport Client RMM installed under ProgramData and beaconing on 725/tcp
Process and software-install events for ProgramData\Prodclear; network flows to 167.148.201[.]106 on 725/tcp. The primary notes the connection is direct-to-IP, so domain-based DNS hunting alone will not surface it
Seen in: Network flow telemetry, EDR
k0t edge-device campaign
MeshAgent installed as a Windows service
Windows System log EventID 7045 service installs with MeshAgent.exe / 'Mesh Agent'; proxy/DNS for agent.ashx and the MeshCentral domains as corroboration
Seen in: Windows event logs / Sysmon / EDR