Windows DNS Queries Initiated by QuickAssist.exe to remoteassistance.support.services.microsoft.com
Alerts when QuickAssist.exe performs DNS lookups for the Microsoft Quick Assist remote session endpoint.
- Product
- windows
- Category
- dns_query
- Author
- Muhammad Faisal (@faisalusuf) (SigmaHQ), DRL 1.1
- Published
- 2024-12-19
- Updated
- 2026-07-31
ATT&CK techniques
Lateral Movement → C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags DNS query events where the process image ends with QuickAssist.exe and the queried name ends with remoteassistance.support.services.microsoft.com. Such name resolution can indicate attempt to establish a Quick Assist session, which may be leveraged during social engineering or initial access workflows. The detection relies on Windows DNS query telemetry that includes the querying process path (Image) and the queried domain name (QueryName).
Reporting behind it
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/
- linkedin.comhttps://www.linkedin.com/posts/kevin-beaumont-security_ive-been-assisting-a-few-orgs-hit-with-successful-activity-7268055739116445701-xxjZ/
- x.comhttps://x.com/cyb3rops/status/1862406110365245506
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_quickassist.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows DNS Queries Initiated by QuickAssist.exe to remoteassistance.support.services.microsoft.com
id: 9fc3eb46-c60d-4d8f-958d-7f10cce61d54
status: experimental
description: This rule flags DNS query events where the process image ends with QuickAssist.exe and the queried name ends with remoteassistance.support.services.microsoft.com. Such name resolution can indicate attempt to establish a Quick Assist session, which may be leveraged during social engineering or initial access workflows. The detection relies on Windows DNS query telemetry that includes the querying process path (Image) and the queried domain name (QueryName).
references:
- https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/
- https://www.linkedin.com/posts/kevin-beaumont-security_ive-been-assisting-a-few-orgs-hit-with-successful-activity-7268055739116445701-xxjZ/
- https://x.com/cyb3rops/status/1862406110365245506
- https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_quickassist.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-12-19
tags:
- attack.command-and-control
- attack.initial-access
- attack.lateral-movement
- attack.t1071.001
- attack.t1210
logsource:
category: dns_query
product: windows
detection:
selection:
Image|endswith: \QuickAssist.exe
QueryName|endswith: remoteassistance.support.services.microsoft.com
condition: selection
falsepositives:
- Legitimate use of Quick Assist in the environment.
level: low
license: DRL-1.1
related:
- id: 882e858a-3233-4ba8-855e-2f3d3575803d
type: derived