DNS Query Request By QuickAssist.EXE to Microsoft Endpoint

SigmaHQ Detections@sigmaHQ

•updated Jun 4, 2025•0•26

Detects DNS queries initiated by "QuickAssist.exe" to the Microsoft Quick Assist primary endpoint. This activity is often associated with social engineering attacks leading to ransomware, where threat actors misuse Quick Assist to gain remote access to a victim's system.