Windows: Process creation matching GoTo Opener (LogMeIn) for remote access tooling

title: "Windows: Process creation matching GoTo Opener (LogMeIn) for remote access tooling"
id: ae54b77a-86b7-4466-92df-f271ccc428ca
status: test
description: This rule flags Windows process creation events where the process metadata matches “GoTo Opener” from LogMeIn, Inc. Adversaries can abuse legitimate remote access/support software to establish interactive command and control within internal networks, blending in with allowed business tools. Telemetry required is Windows process creation data containing descriptive product/company fields.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-4---gotoassist-files-detected-test-on-windows
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_gotoopener.yml
author: frack113, Huntrule Team
date: 2022-02-13
modified: 2023-03-05
tags:
  - attack.command-and-control
  - attack.t1219.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Description: GoTo Opener
    - Product: GoTo Opener
    - Company: LogMeIn, Inc.
  condition: selection
falsepositives:
  - Legitimate use
level: medium
license: DRL-1.1
related:
  - id: b6d98a4f-cef0-4abf-bbf6-24132854a83d
    type: derived