Quick Assist
MITRE ATT&CK: S1209 View on attack.mitre.org
Aliases: Quick Assist
- Malware type
- rat
- Operating systems
- windows, macos
- Profile updated
- 2026-07-07 13:14:09
Context
Quick Assist is a remote assistance tool primarily for Microsoft Windows, although a macOS version also exists. Quick Assist allows for remote screen sharing and, with end user approval, remote control and command execution on the enabling device.
Detection coverage
- 41 Sigma rules
Malware & tools used
- Web Protocols (attack-pattern)
- Screen Capture (attack-pattern)
- Video Capture (attack-pattern)
Used by threat actors
- Black Basta Operator Social Engineering Campaign (campaign)
- Storm-1811 (threat-actor)
Reports & references
- Microsoft — Threat Actors Misusing Quick Assist In Social Engineering Attacks Leading To Ransomware (report)
- MITRE ATT&CK — S1209 (report)
- Microsoft — Quick Assist (report)