Quick Assist Full Control Sharing Mode Enabled
Identifies when Microsoft Quick Assist sharing mode is set to FullControl on a Windows host. This grants the remote helper full interactive control of the target device and may indicate IT help desk fraud,…
Description
Identifies when Microsoft Quick Assist sharing mode is set to FullControl on a Windows host. This grants the remote helper full interactive control of the target device and may indicate IT help desk fraud, unauthorized remote access, or lateral movement preparation.
Detection logic
Its licence does not clear it for publishing here
Sunturai publishes a detection's own text where the licence it arrived under has been reviewed and permits it, and Elastic License 2.0 has not. The query as its source wrote it, its canonical form and the hash that pins this revision are in the workspace record.
MITRE ATT&CK mappings
0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.
References
| Reference | Cited by |
|---|---|
| attack.mitre.org/software/S1209/ | Only this detection cites it |
| www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/ | 4from 2 sources |
From the source
- At source
- Open at source
- Upstream identifier
- 1b1b4236-175f-4863-89f7-7f0d2da0f0e8
- Tagged by the source as
- Data Source: Windows Application Event LogsDomain: EndpointNoise: UnknownOS: WindowsPerformance: NormalPlatform: WindowsResources: Investigation GuideRule Type: Custom Query (KQL)Tactic: Command and ControlTactic: Lateral MovementThreat: Remote Management Tool AbuseUse Case: Threat Detection
Licence
- Published under
- Elastic License 2.0Read the licence
- Attribution
- Required
Authorship
- Written by
- Published
- Sep 20, 2026
- Version
- 3