QuickAssist Execution

Title: QuickAssist Execution
Status: experimental
Description:Detects the execution of Microsoft Quick Assist tool "QuickAssist.exe". This utility can be used by attackers to gain remote access.
References:
  -https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/
  -https://www.linkedin.com/posts/kevin-beaumont-security_ive-been-assisting-a-few-orgs-hit-with-successful-activity-7268055739116445701-xxjZ/
  -https://x.com/cyb3rops/status/1862406110365245506
  -https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist
Author: Muhammad Faisal (@faisalusuf)
Date: 2024-12-19
modified:None
Tags:

• -'attack.command-and-control'
• -'attack.t1219'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\QuickAssist.exe'
  condition:selection
Falsepositives:
  -Legitimate use of Quick Assist in the environment.
Level: low