Windows DNS queries from QuickAssist.exe to remoteassistance.support.services.microsoft.com

title: Windows DNS queries from QuickAssist.exe to remoteassistance.support.services.microsoft.com
id: 9fc3eb46-c60d-4d8f-958d-7f10cce61d54
status: experimental
description: This rule flags DNS queries initiated by QuickAssist.exe where the queried name ends with remoteassistance.support.services.microsoft.com, consistent with contacting the Quick Assist session endpoint. Attackers may abuse legitimate Windows utilities to reach remote services for social engineering, access establishment, or follow-on activity. It relies on Windows DNS query telemetry that records the requesting process image and the queried domain name.
references:
  - https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/
  - https://www.linkedin.com/posts/kevin-beaumont-security_ive-been-assisting-a-few-orgs-hit-with-successful-activity-7268055739116445701-xxjZ/
  - https://x.com/cyb3rops/status/1862406110365245506
  - https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_quickassist.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-12-19
tags:
  - attack.command-and-control
  - attack.initial-access
  - attack.lateral-movement
  - attack.t1071.001
  - attack.t1210
logsource:
  category: dns_query
  product: windows
detection:
  selection:
    Image|endswith: \QuickAssist.exe
    QueryName|endswith: remoteassistance.support.services.microsoft.com
  condition: selection
falsepositives:
  - Legitimate use of Quick Assist in the environment.
level: low
license: DRL-1.1
related:
  - id: 882e858a-3233-4ba8-855e-2f3d3575803d
    type: derived