Remote Management and Monitoring tool - LogMeIn - Network Connection

id: e1f849f9-1218-4990-964d-dd8c69897107
name: Remote Management and Monitoring tool - LogMeIn - Network Connection
description: |
    Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
    https://github.com/jischell-msft/RemoteManagementMonitoringTools
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceNetworkEvents
tactics: CommandAndControl
relevantTechniques: T1219
query: |
  let Time_start = now(-5d);
  let Time_end = now();
  //
  DeviceNetworkEvents
  | where Timestamp between (Time_start..Time_end)
  | where RemoteUrl has_any (
          'update-cdn.logmein.com',
          'secure.logmein.com',
          'update.logmein.com',
          'logmeinrescue.com',
          'logmeinrescue.eu',
          'logmeinrescue-enterprise.com',
          'logmeinrescue-enterprise.eu',
          'remotelyanywhere.com',
          'gotoassist.com',
          'logmeininc.com',
          'logme.in',
          'getgo.com',
          'goto.com',
          'goto-rtc.com',
          'gotomypc.com'
      )
      and InitiatingProcessVersionInfoCompanyName has_any ('LogMeIn', 'GoTo')
  | summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), 
      Report=make_set(ReportId), Count=count() by DeviceId, DeviceName,
      RemoteUrl