Rule Info
Name
QuickAssist Execution
Author
Muhammad Faisal (@faisalusuf)
Description
Detects the execution of Microsoft Quick Assist tool "QuickAssist.exe". This utility can be used by attackers to gain remote access.
Date
2024-12-19 00:00:00
Modified
None
Id
e20b5b14-ce93-4230-88af-981983ef6e74
Tags
attack.command-and-control attack.t1219
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
z00t
Merge PR #5095 from @faisalusuf - Add new rules related to QuickAssist usage
2024-12-19
Scan your endpoints, forensic images or collected files with our portable scanner THOR