Quick Assist
Quick Assist is a remote assistance tool primarily for Microsoft Windows, although a macOS version also exists. Quick Assist allows for remote screen sharing and, with end user approval, remote control and command execution on the enabling device.[1][2]
ID: S1209
ⓘ
Type: TOOL
ⓘ
Platforms: Windows, macOS
Contributors: Liran Ravich, CardinalOps; Joe Gumke, U.S. Bank
Version: 1.0
Created: 14 March 2025
Last Modified: 14 March 2025
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1071 | .001 | Application Layer Protocol: Web Protocols |
Quick Assist communicates over TCP 443 via HTTPS to a remote session server, under which RDP traffic is transferred.[2] |
| Enterprise | T1113 | Screen Capture |
Quick Assist allows for the remote administrator to take screenshots of the running system.[2] |
|
| Enterprise | T1125 | Video Capture |
Quick Assist allows for the remote administrator to view the interactive session of the running machine, including full screen activity.[2][1] |
|
Groups That Use This Software
| ID | Name | References |
|---|---|---|
| G1046 | Storm-1811 |
Storm-1811 used Quick Assist as part of social engineering activity to interact with victims to install follow-on malicious software.[1] |