Potential Evasion via Intel GfxDownloadWrapper

[rule]
description = """
Identifies abuse of the legitimate application GfxDownloadWrapper.exe shipped by Intel to load an arbitrary DLL or
download a remote file. This behavior is used as a defense evasion technique to blend-in malicious activity with
legitimate software.
"""
id = "aafe3c78-15d9-4853-a602-663b8fada5b5"
license = "Elastic License v2"
name = "Potential Evasion via Intel GfxDownloadWrapper"
os_list = ["windows"]
reference = [
    "https://twitter.com/bohops/status/1318767376175976449",
    "https://www.trendmicro.com/en_us/research/23/b/invitation-to-secret-event-uncovering-earth-yako-campaigns.html",
    "https://lolbas-project.github.io/lolbas/Binaries/GfxDownloadWrapper/",
]
version = "1.0.17"

query = '''
process where event.action == "start" and
  (process.pe.original_file_name : "GfxDownloadWrapper.exe" or process.name : "GfxDownloadWrapper.exe") and
   process.parent.executable != null and
   (
    /* run a DLL */
     (process.args : "run" and process.args : ("0", "2")) or

    /* download remote content */
    (process.command_line : "http*" and not process.args : "https://gameplayapi.intel.com/*")
    )
'''

min_endpoint_version = "7.16.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.16.0"