Remote Access Tool - GoToAssist Execution
This rule detects the execution of the GoToAssist remote access tool by looking for specific product and company metadata associated with the process. Adversaries often use legitimate remote access software like GoToAssist to establish command and control over compromised systems, blending in with normal IT support activities.
Sigma
