Skip to content

Hide Navigation Hide TOC

DNS Query Request By QuickAssist.EXE (882e858a-3233-4ba8-855e-2f3d3575803d)

Detects DNS queries initiated by "QuickAssist.exe" to Microsoft Quick Assist primary endpoint that is used to establish a session.

Cluster A Galaxy A Cluster B Galaxy B Level
Exploitation of Remote Services - T1210 (9db0cf3a-a3c9-4012-8268-123b9db6fd82) Attack Pattern DNS Query Request By QuickAssist.EXE (882e858a-3233-4ba8-855e-2f3d3575803d) Sigma-Rules 1
Web Protocols - T1071.001 (df8b2a25-8bdf-4856-953c-a04372b1c161) Attack Pattern DNS Query Request By QuickAssist.EXE (882e858a-3233-4ba8-855e-2f3d3575803d) Sigma-Rules 1
Application Layer Protocol - T1071 (355be19c-ffc9-46d5-8d50-d6a036c675b6) Attack Pattern Web Protocols - T1071.001 (df8b2a25-8bdf-4856-953c-a04372b1c161) Attack Pattern 2