Windows Process Creation: Microsoft QuickAssist.exe Execution

title: "Windows Process Creation: Microsoft QuickAssist.exe Execution"
id: bab66db4-762f-42ed-a069-beb1e20f9af9
status: experimental
description: This rule flags process creation events where the executable filename ends with \QuickAssist.exe. Attackers can abuse Microsoft Quick Assist to establish remote access and support social engineering workflows. It relies on Windows process creation telemetry that records the spawned process image path.
references:
  - https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/
  - https://www.linkedin.com/posts/kevin-beaumont-security_ive-been-assisting-a-few-orgs-hit-with-successful-activity-7268055739116445701-xxjZ/
  - https://x.com/cyb3rops/status/1862406110365245506
  - https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_quickassist_execution.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-12-19
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \QuickAssist.exe
  condition: selection
falsepositives:
  - Legitimate use of Quick Assist in the environment.
level: low
license: DRL-1.1
related:
  - id: e20b5b14-ce93-4230-88af-981983ef6e74
    type: derived