Data Source: Windows Application Event Logs | Detection.FYI

Quick Assist Full Control Sharing Mode Enabled

Jun 22, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Command and Control Tactic: Lateral Movement Data Source: Windows Application Event Logs Resources: Investigation Guide ·
Share on:

Identifies when Microsoft Quick Assist sharing mode is set to FullControl on a Windows host. This grants the remote helper full interactive control of the target device and may indicate IT help desk fraud, unauthorized remote access, or lateral movement preparation.

Read More