medium
advisory
Arbitrary File Download Via GfxDownloadWrapper.EXE
GfxDownloadWrapper.exe can be executed with a URL argument to download files.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 10, 02:50 UTC
- Detection
- 1 rule
- Source quality
- A2Roughly even chance
GfxDownloadWrapper.exe can be executed via the command line with a URL as an argument to download files. This behavior is tracked by the LOLBAS Project.
Detection
Monitor process creation events for GfxDownloadWrapper.exe where the command line contains 'http://' or 'https://', excluding known legitimate traffic to 'https://gameplayapi.intel.com/'.
Detection coverage 1
Detect Arbitrary File Download via GfxDownloadWrapper.exe
mediumDetects execution of GfxDownloadWrapper.exe with a URL argument, excluding known legitimate Intel update paths.
sigma
tactics: command-and-control
techniques: T1105
sources: process_creation, windows
Detection queries are available on the platform. Get full rules →