Windows LogMeIn LMIGuardianSvc Execution Associated with Remote Access Tools
Flags Windows process launches identified as LogMeIn LMIGuardianSvc by Description/Product/Company attributes.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-02-11
- Updated
- 2026-07-30
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule matches process creation events where the process metadata indicates the LogMeIn service "LMIGuardianSvc" (matched via Description, Product, and Company fields). Attackers may leverage legitimate remote access tooling to establish interactive control or support-like access within target networks, so unusual execution of vendor-branded components can be a useful signal. The detection relies on Windows process creation telemetry containing these process attribute fields.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-3---logmein-files-detected-test-on-windows
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_logmein.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows LogMeIn LMIGuardianSvc Execution Associated with Remote Access Tools
id: 8d47c82f-4796-467c-a3be-609c9c3ae068
status: test
description: This rule matches process creation events where the process metadata indicates the LogMeIn service "LMIGuardianSvc" (matched via Description, Product, and Company fields). Attackers may leverage legitimate remote access tooling to establish interactive control or support-like access within target networks, so unusual execution of vendor-branded components can be a useful signal. The detection relies on Windows process creation telemetry containing these process attribute fields.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-3---logmein-files-detected-test-on-windows
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_logmein.yml
author: frack113, Huntrule Team
date: 2022-02-11
modified: 2023-03-05
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
category: process_creation
product: windows
detection:
selection:
- Description: LMIGuardianSvc
- Product: LMIGuardianSvc
- Company: LogMeIn, Inc.
condition: selection
falsepositives:
- Legitimate use
level: medium
license: DRL-1.1
related:
- id: d85873ef-a0f8-4c48-a53a-6b621f11729d
type: derived