GoToAssist Temporary Installation Artefact File Creation (Windows)

title: GoToAssist Temporary Installation Artefact File Creation (Windows)
id: 86ac261b-d322-4b94-93a5-89ac9ca32ea3
status: test
description: This rule matches Windows file events where the target filename contains the GoToAssist Remote Support Expert temporary installation path under the user’s %AppData%\Local\Temp directory. Attackers can use legitimate remote support tooling to establish interactive control, and temporary installation artifacts are an observable byproduct of that activity. The detection relies on Windows file-event telemetry capturing the affected filename and path.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-4---gotoassist-files-detected-test-on-windows
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_gotoopener_artefact.yml
author: frack113, Huntrule Team
date: 2022-02-13
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains: \AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Expert\
  condition: selection
falsepositives:
  - Legitimate use
level: medium
license: DRL-1.1
related:
  - id: 5d756aee-ad3e-4306-ad95-cb1abec48de2
    type: derived