Quick Assist

Overview

Evidence: Quick Assist Description: Collect Quick Assist Category: Remote Access Platform: Windows Short Name: quickass Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

Windows Quick Assist provides remote assistance capabilities and maintains logs of remote access sessions. This data is essential for understanding remote access activities and detecting unauthorized remote access.

Data Collected

This collector gathers structured data about quick assist.

Quick Assist Data

Field	Description	Example
ID	Primary key (auto-increment)	1
SessionID	Session ID	12345678-1234-1234-1234-123456789012
StartTime	Session start time	2023-10-15 14:30:25
EndTime	Session end time	2023-10-15 15:30:25
Duration	Session duration in seconds	3600
RemoteUser	Remote user	[email protected]
LocalUser	Local user	Administrator
ConnectionType	Connection type	Remote Assistance
Status	Session status	Completed

Collection Method

This collector parses the necessary data from the quick_assist table.

This collector collects files from the following locations:

• %LOCALAPPDATA%\Microsoft\QuickAssist\

Usage

This evidence is crucial for forensic investigations as it provides remote access session information. It helps investigators understand remote access activities, detect unauthorized remote access, and investigate remote-based attacks. The data can reveal remote sessions, access patterns, and potential security incidents. Analysts can use this information to identify remote compromises, trace access activities, and assess remote security posture.

Notes

This data may contain sensitive information that should be handled according to data protection requirements. Ensure proper chain of custody is maintained during collection and analysis.