Microsoft Quick Assist Unsolicited Launch

Sigmamediumv12026-07-28

sigmamicrosoft-quick-assist-unsolicited-launch-d6cd3050

title: Microsoft Quick Assist Unsolicited Launch
id: 4c91e3d1-dd3b-4e76-8dd7-8f8c34917928
description: Detects execution of Microsoft Quick Assist, potentially unsolicited, as seen in initial access phases attributed to UNC6692.
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\QuickAssist.exe'
  condition: selection
level: medium
tags:
  - "attack.t1566"
references:
  - "https://www.esentire.com/blog/email-bombing-it-impersonation-quick-assist-and-edgecution-breaking-down-unc6692s-tradecraft"

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.