Detectionlowexperimental
DNS Query Request By QuickAssist.EXE
Detects DNS queries initiated by "QuickAssist.exe" to Microsoft Quick Assist primary endpoint that is used to establish a session.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
WindowsDNS Query
ProductWindows← raw: windows
CategoryDNS Query← raw: dns_query
DNS lookup events generated by endpoint monitoring tools.
Detection Logic
Detection Logic1 selector
detection:
selection:
Image|endswith: '\QuickAssist.exe'
QueryName|endswith: 'remoteassistance.support.services.microsoft.com'
condition: selectionFalse Positives
Legitimate use of Quick Assist in the environment.
MITRE ATT&CK
Rule Metadata
Rule ID
882e858a-3233-4ba8-855e-2f3d3575803d
Status
experimental
Level
low
Type
Detection
Created
Thu Dec 19
Author
Path
rules/windows/dns_query/dns_query_win_quickassist.yml
Raw Tags
attack.command-and-controlattack.initial-accessattack.lateral-movementattack.t1071.001attack.t1210