Detection of GoToAssist Remote Support Temporary Artifacts

Remote access tools such as GoToAssist are frequently leveraged by adversaries to maintain persistence and establish command-and-control (C2) channels within target networks. Because these tools are widely used for legitimate technical support and help-desk operations, they are often permitted by application control policies, allowing attackers to blend in with authorized administrative activity. During the execution of the GoToAssist remote support installer or the GoToOpener application, the software creates specific temporary files and directory structures within the user's AppData path. Detecting the creation of these specific artifacts serves as a high-fidelity signal for identifying the initialization of unauthorized remote access sessions in environments where such software should not be present or is restricted to specific, authorized IT accounts.

Impact

Successful abuse of GoToAssist enables unauthorized remote interactive access to target endpoints. This provides an attacker with the ability to execute commands, transfer files, and interact with the desktop environment, facilitating data exfiltration, lateral movement, or the deployment of further malicious payloads. In many cases, this activity bypasses standard security controls that rely on blocking unknown or blacklisted remote access binaries.

Recommendation

• Deploy the provided Sigma rule to monitor for the creation of GoToAssist-related temporary files within the user AppData directory.
• Implement application control or software restriction policies to block the execution of GoToAssist binaries by non-authorized users.
• Investigate any file creation events originating from the paths identified in the Sigma rule to determine if the activity is associated with a legitimate support session or unauthorized access.