{
  "Name": "LogMeIn",
  "Category": "RMM",
  "Description": "LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.\n",
  "Author": "Nasreddine Bencherchali",
  "Created": "2024-08-05",
  "LastModified": "2024-08-05",
  "Details": {
    "Website": "https://www.logmein.com/",
    "PEMetadata": [
      {
        "Filename": "lmiguardiansvc.exe"
      },
      {
        "Filename": "lmiignition.exe"
      },
      {
        "Filename": "logmeinsystray.exe"
      },
      {
        "Filename": "logmein.exe",
        "OriginalFileName": "",
        "Company": "LogMeIn, Inc.",
        "Description": "LMIGuardianSvc",
        "Product": "LMIGuardianSvc"
      }
    ],
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": null
  },
  "Artifacts": {
    "Disk": [],
    "EventLog": [],
    "Registry": [],
    "Network": [
      {
        "Description": "N/A",
        "Domains": [
          "logmein-gateway.com"
        ],
        "Ports": [
          443
        ]
      },
      {
        "Description": "N/A",
        "Domains": [
          "*.logmein.com"
        ],
        "Ports": [
          443
        ]
      },
      {
        "Description": "N/A",
        "Domains": [
          "*.logmein.eu"
        ],
        "Ports": [
          443
        ]
      },
      {
        "Description": "N/A",
        "Domains": [
          "logmeinrescue.com"
        ],
        "Ports": [
          443
        ]
      },
      {
        "Description": "N/A",
        "Domains": [
          "*.logmeininc.com"
        ],
        "Ports": [
          443
        ]
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/SigmaHQ/sigma/blob/782f0f524e6f797ea114fe0d87b22cb4abaa6b7c/rules/windows/dns_query/dns_query_win_remote_access_software_domains_non_browsers.yml",
      "Description": "DNS Query To Remote Access Software Domain From Non-Browser App"
    },
    {
      "Sigma": "https://github.com/SigmaHQ/sigma/blob/782f0f524e6f797ea114fe0d87b22cb4abaa6b7c/rules/windows/process_creation/proc_creation_win_remote_access_tools_logmein.yml",
      "Description": "Remote Access Tool - LogMeIn Execution"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/logmein_network_sigma.yml",
      "Description": "Detects potential network activity of LogMeIn RMM tool"
    }
  ],
  "References": [
    "https://support.logmeininc.com/central/help/allowlisting-and-firewall-configuration"
  ],
  "Acknowledgement": [
    {
      "Person": "Nasreddine Bencherchali",
      "Handle": "@nas_bench"
    }
  ],
  "CodeSigning": {
    "certificates": [
      {
        "signer_name": "GoTo Technologies USA, LLC",
        "certificate_thumbprint": "33023C0243016946C78CCB9B15AC6C203882E5D9",
        "certificate_der_base64": "MIIH2TCCBcGgAwIBAgIQDq06P/pwwKIK4jaBiZNRUzANBgkqhkiG9w0BAQwFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTI1MDgyMTAwMDAwMFoXDTI4MDgyMjIzNTk1OVowgeExEzARBgsrBgEEAYI3PAIBAxMCVVMxGTAXBgsrBgEEAYI3PAIBAhMIRGVsYXdhcmUxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRAwDgYDVQQFEwc1OTg0MTEyMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEPMA0GA1UEBxMGQm9zdG9uMSMwIQYDVQQKExpHb1RvIFRlY2hub2xvZ2llcyBVU0EsIExMQzEjMCEGA1UEAxMaR29UbyBUZWNobm9sb2dpZXMgVVNBLCBMTEMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDXBnwWFr1Haugt1kOHarj31h9QgazDGc0Ijs8ownMkZ9WxjYhDNd1AfzNc6Rv1IWM52EYnFZfsP24vfDSXsMWQVPqNSAeP6HcNF3zZ3vVVNpydrbX43l2ZqIs3WIw1Y9QFJxRiDgJaPHC8S3XmXvrEGIWMGEUidteAm5c7lAEkklohrxWWnvYZQ6Bk6TrVAqkDKzlXovqL39ERdX1b3vprbudHhZHQAyax5sYb24nlA4y9NpzYKAY7KivhhOQNDJ46TjMCsGfQuyo0Ni21+KjNvMcRcVOh3G/VSSEpg2AIUV6GWa3/XQXBuXyTPj2h5wf6x84d2wzV6XJ9GyxpD8eZLf/9QxMoqAxS0/tlOKpPgEVGh9BhlFyLVaX4AolLE48qhZSL6tIs74965yyrp0OzRierAh2VXoF79Cp5wKdu9id9ztlP72sY5Qf0EUSMFFEe5aS9RY0Fu2PxT5CR2ZdKtSBtYK1nwagYYPjmNW8bO5FC89JiZlcLDVeIyQeAPo3ZSuMhZCz0S12t2QpktFZvEJ1VIayQTC63N9S4VrQRnusnlxJLImrrfu0bI8F9fUoaUwJo14/2lwSczOdmfZxo3bKqQSkrMSBeNixUWeiyrPUczLe5DfgUdzmtJ4fJOTkEQEkNaQ9ed+u4ItEZACUX7ujgYZsJ8a8ClUmrx62yPQIDAQABo4ICAjCCAf4wHwYDVR0jBBgwFoAUaDfg67Y7+F8Rhvv+YXsIiGX0TkIwHQYDVR0OBBYEFLYSDl2IK7QIyBrxGqwuqqHXUmXDMD0GA1UdIAQ2MDQwMgYFZ4EMAQMwKTAnBggrBgEFBQcCARYbaHR0cDovL3d3dy5kaWdpY2VydC5jb20vQ1BTMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzCBtQYDVR0fBIGtMIGqMFOgUaBPhk1odHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNybDBToFGgT4ZNaHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcmwwgZQGCCsGAQUFBwEBBIGHMIGEMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wXAYIKwYBBQUHMAKGUGh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3J0MAkGA1UdEwQCMAAwDQYJKoZIhvcNAQEMBQADggIBALVnUZsOeb8GoGLjBT3VRdyLnQEuKwn41b8I6fWfIF5jnYtOzW/dJqOuIXvs0LSQ8FHHpvWYUPqjL94pp+SHWCreuCZ6iLrt/tXCmWYUkhU4DY2m4ddNEAvuJaqzcwg8xjrzlHvpyKInfeB8jUujc8Rf/oWVLsgPaI/mp9wkSmVwytA9vnS8mi/BH14/wICihbwuNN9N+uHbeJowiw8NZGxteanaHgoLTZ76adJEOGoHkbtyXDZL7YII8d1HUvwMjB1h1ZxEtFtpYZesvRfSa99pt+jbyeYOXXTxYwyHGtDqTmX3RAKTETtPEsqlY/IZ+MPqLZs/YQORlVrUEC3VCWdUvQvCZpItxAX9Y98bBQzjCAUSqFP7RznSbvtwJwmQaXR1ul2sn22rV2HUpF+C4JuWd1Aq/aD+UQcZcqtiQVag+vBVmXYevdPRFr7v+TauGPIqdSH/igbj2vl/mAV6aG49VSYgz9GMNM33CoLSzydASa2ifgybt4tDsmlqjP2FE1JKVSXN6YxrhEOC0YOi7eugU1JSJrHubaUvRCiUBD5qfN8HOzR6CzOy82FEAurAG4EB56H7W+L1rQhqG5J8/gkPK50kZobrCS/cQ2iK3S7735myNL8zkXfjrwjFuFqpy69crtvDqmlYWsBxlkYdg8EKb/yTlCAicCQyCG5Y4YD3",
        "src_file_sha256": "9b6f4f5e6f85dfe628f9781e65ab8917bf9f7d3e24bb6c564ab2fc0020a93f32",
        "src_file_path": "downloaded_files/logmein/9b6f4f5e6f85dfe628f9781e65ab8917bf9f7d3e24bb6c564ab2fc0020a93f32",
        "src_file_company": "LogMeIn, Inc."
      },
      {
        "signer_name": "GoTo Technologies USA, LLC",
        "certificate_thumbprint": "8D3FA6EEEBFC68A0FA76CDC4C6AD5982FE07DE91",
        "certificate_der_base64": "MIIHWTCCBUGgAwIBAgIQDgyHZ7stT+/C1hffEc4biTANBgkqhkiG9w0BAQwFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTI0MDUxMzAwMDAwMFoXDTI3MDUxMjIzNTk1OVowgeExEzARBgsrBgEEAYI3PAIBAxMCVVMxGTAXBgsrBgEEAYI3PAIBAhMIRGVsYXdhcmUxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRAwDgYDVQQFEwc1OTg0MTEyMQswCQYDVQQGEwJVUzEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEPMA0GA1UEBxMGQm9zdG9uMSMwIQYDVQQKExpHb1RvIFRlY2hub2xvZ2llcyBVU0EsIExMQzEjMCEGA1UEAxMaR29UbyBUZWNobm9sb2dpZXMgVVNBLCBMTEMwggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQDc511p+U4/ceMa+9gCeidFo8xSj0RQ1VyClI4OP3etR4zxyPnjb4hyLm72YUTyqkJ0Y3b2LOde6UkUuxEG1gT9H0VNZhcKrxmWZ21Ir0vmqXUkfooGRis19bQq1GXnxUyMnhco8auWC4lZJVHsz+dfV88cHLeLvlLT3YXxawpl/uLvH9Vu+tI5CS9asbfzYGBZic6lQaZ+U2nz1QUlN0WWOuWFqL0GiEIlJ+a+avoouNeJpyUThxThX0IKwRUD4LNAzTfyaMiAJXcwARnNgMgcW6YrWEkb0x8BQ3hNVuVizzDEMrMUF1UiGXk+rYefPGdA51wt6wENKXucYHcny6zET0IHVit9zhyXscmtYgz6hwEWV1ale6Zjm2hI1uLNlALB00SDzi4qXMlhWA3bggboQwCrBpO584EXR4955wSuo05Ug7CP+bdCBpDIgG2rB+BeXcnCRFDzilQXt7nRjO050o4tg3K0zdzpXnrSM1mrd/UYw7cfnKy1A6WHK/IMGAECAwEAAaOCAgIwggH+MB8GA1UdIwQYMBaAFGg34Ou2O/hfEYb7/mF7CIhl9E5CMB0GA1UdDgQWBBSnyrp99WDe7wuDoNKOpFjILc5AfDA9BgNVHSAENjA0MDIGBWeBDAEDMCkwJwYIKwYBBQUHAgEWG2h0dHA6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAOBgNVHQ8BAf8EBAMCB4AwEwYDVR0lBAwwCgYIKwYBBQUHAwMwgbUGA1UdHwSBrTCBqjBToFGgT4ZNaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcmwwU6BRoE+GTWh0dHA6Ly9jcmw0LmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3JsMIGUBggrBgEFBQcBAQSBhzCBhDAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuZGlnaWNlcnQuY29tMFwGCCsGAQUFBzAChlBodHRwOi8vY2FjZXJ0cy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNydDAJBgNVHRMEAjAAMA0GCSqGSIb3DQEBDAUAA4ICAQAB5/85dwc018g+cEZViyy1TAraBLqm/YWb/ZVqc1L8C2a/XRReSW5h4w8QtXHOu9kqxVhk20WILztg22kzwH8vJcTHmnGZ2g3OWHufQV/r8pPHM+XedATAZ/v5hSs8BeySPQkessVmmGR8jdk1UzQtXbwbhfhGJc2luPhz9SWW/PG7lZaX6NmD3VtFkf5fjwj0JXO7O/UbKwJVX1jBhc9t0AfuPrpSZjZ/XYIPKA4HXJQjecxIbHxjDBQqyiGs2A8OgibT6dOHT0wh8gJ/lzqNMMae44ToDXj4V736e2L9lllQVMCo3KPjGk0nDE+sYTqoU0kODwUyrW9DbNUUqjolvJxFTQVFcINkLDxOq0KxlXqmZ7V9Rjd939skXYvK2qe29HxHIkH1iEoZIP/WmrZdwa5B8HiWEl7G2Qsz6vT78D4llJOaNVXHFHONE4OLOoC5vcMEO5s4Xxbay7IBkXBm5f49fKuPY3j7+PMpeXqAYkKhcJURPFklu4AyoRq+YCN7S4/WtRpke3nLK6t1yLdqaQ6vxQAWmIdXIpIqEqGnnED4IdH6ROi4h2J8FMunZcBpQfyiIYMfZgKn4Y5VeeNlqdPpbxPT0Zc4AIQ8b9guG1R2hnfntqt6uOVSCPPMMSTLzEKvYtButJ29lG3M2M+7eJ2NuCPcoCMMKwTxRSa/Qw==",
        "src_file_sha256": "71cf94f02a53c2a37976acbb0a87fd8bb0edda247c780ca61fbe4a41a17406a5",
        "src_file_path": "downloaded_files/logmein/71cf94f02a53c2a37976acbb0a87fd8bb0edda247c780ca61fbe4a41a17406a5",
        "src_file_company": "LogMeIn, Inc."
      }
    ]
  }
}