Windows: Process creation matching GoTo Opener (LogMeIn) for remote access tooling
Alerts on Windows process execution identified as “GoTo Opener” by LogMeIn, which may indicate remote access tool use.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-02-13
- Updated
- 2026-07-30
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where the process metadata matches “GoTo Opener” from LogMeIn, Inc. Adversaries can abuse legitimate remote access/support software to establish interactive command and control within internal networks, blending in with allowed business tools. Telemetry required is Windows process creation data containing descriptive product/company fields.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-4---gotoassist-files-detected-test-on-windows
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_gotoopener.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Process creation matching GoTo Opener (LogMeIn) for remote access tooling"
id: ae54b77a-86b7-4466-92df-f271ccc428ca
status: test
description: This rule flags Windows process creation events where the process metadata matches “GoTo Opener” from LogMeIn, Inc. Adversaries can abuse legitimate remote access/support software to establish interactive command and control within internal networks, blending in with allowed business tools. Telemetry required is Windows process creation data containing descriptive product/company fields.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-4---gotoassist-files-detected-test-on-windows
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_gotoopener.yml
author: frack113, Huntrule Team
date: 2022-02-13
modified: 2023-03-05
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
category: process_creation
product: windows
detection:
selection:
- Description: GoTo Opener
- Product: GoTo Opener
- Company: LogMeIn, Inc.
condition: selection
falsepositives:
- Legitimate use
level: medium
license: DRL-1.1
related:
- id: b6d98a4f-cef0-4abf-bbf6-24132854a83d
type: derived