Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
13 detections
Filters
Last updated
All Time
Detection languages
6
3
2
1
1
Contributors
5
3
2
1
1
Categories
8
7
5
2
1
Platforms
13
2
Products / Services
3
3
2
2
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects instances where Microsoft Teams or its associated process spawns remote assistance utilities such as Quick Assist, Microsoft Remote Assistance (msra), or Remote Desktop Connection Manager (msrdcw). This behavior may indicate an attacker abusing legitimate remote access software for command and control or unauthorized remote control.
This rule detects the execution of Microsoft Quick Assist (msra.exe or quickassist.exe) on endpoints. It elevates the risk score if the event is preceded by Microsoft Teams activity within 30 minutes or occurs on a host exhibiting high volumes of email traffic, which may indicate remote access tool abuse following a social engineering or phishing attempt.
This rule detects the execution of Quick Assist (quickassist.exe) or Microsoft Remote Assistance (msra.exe) in scenarios where the parent process, causality chain, or command line includes references to Microsoft Teams. This behavior is indicative of social engineering attempts where attackers impersonate IT support via Teams to induce users to launch remote access tools, a tactic observed in campaigns like BlackBasta.
Detects execution of Windows remote assistance tools like Quick Assist, msrdcw, or msra when spawned by unexpected parent processes, or when spawned by Microsoft Teams. This behavior may indicate an adversary abusing legitimate remote access software to maintain persistence, conduct lateral movement, or gain interactive access to a compromised system.
Detects privilege escalation events (assigning special privileges or executing privileged operations) occurring on a host shortly after the execution of legitimate remote support tools such as Quick Assist or msra.exe. This pattern is consistent with social engineering campaigns where attackers gain remote access via support tools and then perform local privilege escalation.
This rule detects a multi-stage attack chain associated with the Nimbus RAT, starting with a suspicious Microsoft Teams message (vishing) from an external sender using throwaway domains (e.g., .onmicrosoft.com, .top). This initial communication is then correlated with subsequent reconnaissance activities performed via Quick Assist, where QuickAssist.exe spawns cmd.exe to execute commands like 'net time', '/domain', 'whoami', 'ipconfig', or 'systeminfo' on the victim's device within a two-hour window. The rule aims to identify the internal victim and the external sender involved in this coordinated attack.
Detects Quick Assist spawning command interpreters (cmd.exe, powershell.exe, pwsh.exe) that execute common discovery and reconnaissance commands. This pattern is associated with hands-on-keyboard activity, as documented in campaigns like Nimbus RAT, and broader kill chains used by groups such as Storm-1811, Black Basta affiliates, and 3AM ransomware operators. The rule specifically looks for commands like 'whoami', 'ipconfig', 'systeminfo', 'hostname', 'net time', 'net user', 'net group', 'net localgroup', 'net view', 'nltest', 'qwinsta', 'tasklist', 'arp', 'route', 'netstat', '/domain', 'dsquery', and 'gpresult'.
Identifies QuickAssist.exe launching cmd.exe to perform network and domain discovery commands. This behavior is indicative of post-exploitation reconnaissance following a remote support session, commonly seen in Nimbus RAT campaigns.
KQL Query from file: Storm 1811 SE Attack Detection
KQL Query from file: MDE: Detecting Quick Assist Usage
This rule detects DNS queries to domains associated with legitimate remote access software (e.g., TeamViewer, Go2Assist, LogMeIn, AmmyyAdmin, RustDesk, Quick Assist, Remote Utilities, Tailscale, Twingate, NetSupport Manager) when those queries originate from a non-browser application. Adversaries often leverage these legitimate tools to establish command and control (C2) channels or maintain persistence on compromised systems, as they may be allowed by application control policies. The rule includes extensive filters to exclude common web browsers and other legitimate system processes that might legitimately query these domains, aiming to reduce false positives.
Detects the execution of the Microsoft Quick Assist tool, 'QuickAssist.exe'. This utility can be leveraged by attackers to gain remote access to a system, often in social engineering attacks leading to further compromise like ransomware.
Detects DNS queries initiated by "QuickAssist.exe" to the Microsoft Quick Assist primary endpoint. This activity is often associated with social engineering attacks leading to ransomware, where threat actors misuse Quick Assist to gain remote access to a victim's system.