Windows Process Creation: Microsoft QuickAssist.exe Execution
Alerts on execution of QuickAssist.exe by matching the process image ending with \QuickAssist.exe.
FreeReviewedSigma · Low · v1
- Product
- windows
- Category
- process_creation
- Author
- Muhammad Faisal (@faisalusuf) (SigmaHQ), DRL 1.1
- Published
- 2024-12-19
- Updated
- 2026-07-30
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags process creation events where the executable filename ends with \QuickAssist.exe. Attackers can abuse Microsoft Quick Assist to establish remote access and support social engineering workflows. It relies on Windows process creation telemetry that records the spawned process image path.
Reporting behind it
- microsoft.comhttps://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/
- linkedin.comhttps://www.linkedin.com/posts/kevin-beaumont-security_ive-been-assisting-a-few-orgs-hit-with-successful-activity-7268055739116445701-xxjZ/
- x.comhttps://x.com/cyb3rops/status/1862406110365245506
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_quickassist_execution.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-microsoft-quickassist-exe-execution-e20b5b14
title: "Windows Process Creation: Microsoft QuickAssist.exe Execution"
id: bab66db4-762f-42ed-a069-beb1e20f9af9
status: experimental
description: This rule flags process creation events where the executable filename ends with \QuickAssist.exe. Attackers can abuse Microsoft Quick Assist to establish remote access and support social engineering workflows. It relies on Windows process creation telemetry that records the spawned process image path.
references:
- https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/
- https://www.linkedin.com/posts/kevin-beaumont-security_ive-been-assisting-a-few-orgs-hit-with-successful-activity-7268055739116445701-xxjZ/
- https://x.com/cyb3rops/status/1862406110365245506
- https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_quickassist_execution.yml
author: Muhammad Faisal (@faisalusuf), Huntrule Team
date: 2024-12-19
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \QuickAssist.exe
condition: selection
falsepositives:
- Legitimate use of Quick Assist in the environment.
level: low
license: DRL-1.1
related:
- id: e20b5b14-ce93-4230-88af-981983ef6e74
type: derived