RMM
LogMeIn
LogMeIn is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.
Tool overview
- Category
- RMM
- Research authors
- Nasreddine Bencherchali
- Created
- 2024-08-05
- Last modified
- 2024-08-05
- Privileges
- Not recorded
- Free / availability
- Not recorded
- Verification required
- Not recorded
- Supported platforms
- Not recorded
Executables & installation paths
- Filename
- lmiguardiansvc.exe
- Filename
- lmiignition.exe
- Filename
- logmeinsystray.exe
- Filename
- logmein.exe
- OriginalFileName
- Not recorded
- Company
- LogMeIn, Inc.
- Description
- LMIGuardianSvc
- Product
- LMIGuardianSvc
Installation paths
Not recorded
Code signing
- signer name
- GoTo Technologies USA, LLC
- certificate thumbprint
- 33023C0243016946C78CCB9B15AC6C203882E5D9
- src file sha256
- 9b6f4f5e6f85dfe628f9781e65ab8917bf9f7d3e24bb6c564ab2fc0020a93f32
- src file path
- downloaded_files/logmein/9b6f4f5e6f85dfe628f9781e65ab8917bf9f7d3e24bb6c564ab2fc0020a93f32
- src file company
- LogMeIn, Inc.
- signer name
- GoTo Technologies USA, LLC
- certificate thumbprint
- 8D3FA6EEEBFC68A0FA76CDC4C6AD5982FE07DE91
- src file sha256
- 71cf94f02a53c2a37976acbb0a87fd8bb0edda247c780ca61fbe4a41a17406a5
- src file path
- downloaded_files/logmein/71cf94f02a53c2a37976acbb0a87fd8bb0edda247c780ca61fbe4a41a17406a5
- src file company
- LogMeIn, Inc.
FORENSIC EVIDENCE
Network artifacts
- Description
- N/A
- Domains
- logmein-gateway.com
- Ports
- 443
- Description
- N/A
- Domains
- *.logmein.com
- Ports
- 443
- Description
- N/A
- Domains
- *.logmein.eu
- Ports
- 443
- Description
- N/A
- Domains
- logmeinrescue.com
- Ports
- 443
- Description
- N/A
- Domains
- *.logmeininc.com
- Ports
- 443
Detections
- Sigma
- https://github.com/SigmaHQ/sigma/blob/782f0f524e6f797ea114fe0d87b22cb4abaa6b7c/rules/windows/dns_query/dns_query_win_remote_access_software_domains_non_browsers.yml
- Description
- DNS Query To Remote Access Software Domain From Non-Browser App
- Sigma
- https://github.com/SigmaHQ/sigma/blob/782f0f524e6f797ea114fe0d87b22cb4abaa6b7c/rules/windows/process_creation/proc_creation_win_remote_access_tools_logmein.yml
- Description
- Remote Access Tool - LogMeIn Execution
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/logmein_network_sigma.yml
- Description
- Detects potential network activity of LogMeIn RMM tool
References
Acknowledgements
- Person
- Nasreddine Bencherchali
- Handle
- @nas_bench