.. /.Msrcincident

Phishing

Contributors:

mr.d0x

Description:

MSRCINCIDENT files are XML format documents used by the Windows Remote Assistance program to take control of your computer.

OS:

Windows

Recommendation:

Block the download and execution of MSRCINCIDENT files.

Resources:

https://www.bleepingcomputer.com/news/security/windows-remote-assistance-tool-can-be-used-for-targeted-attacks/

File Samples: