Elastic medium stable kql

Quick Assist Full Control Sharing Mode Enabled

Identifies when Microsoft Quick Assist sharing mode is set to FullControl on a Windows host. This grants the remote helper full interactive control of the target device and may indicate IT help desk fraud, unauthorized remote access, or lateral movement preparation.

View Source

Detection Logic

host.os.type:windows and winlog.channel:"Application" and event.provider:"Quick Assist" and event.code:"0" and
  winlog.event_data.param1:(*FullControl* and *setsharingmode*)

Field Validations

Loading…

Comments (0)

Loading comments...