LogMeIn Guardian Service Execution

SigmaHQ Detections@sigmaHQ

•updated Jun 13, 2025•0•13

This rule detects the execution of LogMeIn Guardian Service (LMIGuardianSvc) based on its description, product name, or company name. LogMeIn is a legitimate remote access tool that can be abused by adversaries to establish command and control over compromised systems. The rule specifically looks for process creation events where the 'Description' or 'Product' field contains 'LMIGuardianSvc' or the 'Company' field is 'LogMeIn, Inc.'.