[WINDOWS-SECURITY] CRITICAL - Microsoft Quick Assist Executed

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SECURITY] CRITICAL - Microsoft Quick Assist Executed"; program:*Security*; event_id:4688; content:"QuickAssist.exe"; normalize; json_map: "src_ip", ".xff"; threshold: type suppress, track by_src, count 1, seconds 3600; classtype:command-and-control; sid:5015506; rev:3; metadata:created_at 2025_03_06, updated_at 2025_09_01, mitre_tactic_id TA0011, mitre_technique_id T1219;)