GoToAssist Temporary File Drop in Windows Temp Directory
Flags creation of GoToAssist Remote Support Expert temp installation artefacts under Windows AppData\Temp.
- Product
- windows
- Category
- file_event
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-02-13
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies the creation of a specific GoToAssist temporary artifact by matching file paths under the Windows user Temp directory associated with “GoToAssist Remote Support Expert.” Attackers may use legitimate remote support software to establish interactive access, and transient installation or support artifacts can appear in user-local temporary locations during setup. It relies on Windows file event telemetry that records the target filename/path so the directory substring can be matched.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-4---gotoassist-files-detected-test-on-windows
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_gotoopener_artefact.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: GoToAssist Temporary File Drop in Windows Temp Directory
id: 86ac261b-d322-4b94-93a5-89ac9ca32ea3
status: test
description: This rule identifies the creation of a specific GoToAssist temporary artifact by matching file paths under the Windows user Temp directory associated with “GoToAssist Remote Support Expert.” Attackers may use legitimate remote support software to establish interactive access, and transient installation or support artifacts can appear in user-local temporary locations during setup. It relies on Windows file event telemetry that records the target filename/path so the directory substring can be matched.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-4---gotoassist-files-detected-test-on-windows
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_gotoopener_artefact.yml
author: frack113, Huntrule Team
date: 2022-02-13
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains: \AppData\Local\Temp\LogMeInInc\GoToAssist Remote Support Expert\
condition: selection
falsepositives:
- Legitimate use
level: medium
license: DRL-1.1
related:
- id: 5d756aee-ad3e-4306-ad95-cb1abec48de2
type: derived