GoToAssist Temporary Installation Artefact
This rule detects the creation of temporary installation artifacts for GoToAssist Remote Support Expert in the user's AppData\Local\Temp directory. Adversaries often use legitimate remote access tools like GoToAssist to establish command and control, and the presence of these temporary files can indicate such activity.
Sigma
