Windows: GfxDownloadWrapper.exe used for arbitrary file download from a URL

title: "Windows: GfxDownloadWrapper.exe used for arbitrary file download from a URL"
id: 218e3dc1-f609-408e-915d-2d065bd313f7
status: test
description: This rule identifies Windows process executions of GfxDownloadWrapper.exe when the command line includes an HTTP or HTTPS URL argument. Attackers may use this living-off-the-land style utility to pull payloads or files over the network while minimizing custom tooling. The detection relies on process creation telemetry that records the executed image path and the full command line, and it excludes a known gameplayapi.intel.com URL to reduce noise.
references:
  - https://lolbas-project.github.io/lolbas/HonorableMentions/GfxDownloadWrapper/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_gfxdownloadwrapper_arbitrary_file_download.yml
author: Victor Sergeev, oscd.community, Huntrule Team
date: 2020-10-09
modified: 2023-10-18
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \GfxDownloadWrapper.exe
    CommandLine|contains:
      - http://
      - https://
  filter_main_known_urls:
    CommandLine|contains: https://gameplayapi.intel.com/
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: eee00933-a761-4cd0-be70-c42fe91731e7
    type: derived