Arbitrary File Download Via GfxDownloadWrapper.EXE

Title: Arbitrary File Download Via GfxDownloadWrapper.EXE
Status: test
Description:Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.
References:
  -https://lolbas-project.github.io/lolbas/HonorableMentions/GfxDownloadWrapper/
Author: Victor Sergeev, oscd.community
Date: 2020-10-09
modified:2023-10-18
Tags:

• -'attack.command-and-control'
• -'attack.t1105'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\GfxDownloadWrapper.exe'
    CommandLine|contains:
      -'http://'
      -'https://'

  filter_main_known_urls:
    CommandLine|contains: 'https://gameplayapi.intel.com/'
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: medium