rules/windows/powershell/powershell_susp_athremotefxvgpudisablementcommand.yml

title: Abusable Invoke-ATHRemoteFXvGPUDisablementCommand
id: 38a7625e-b2cb-485d-b83d-aff137d859f4
status: experimental
author: frack113
date: 2021/07/13
modified: 2021/09/07
description: RemoteFXvGPUDisablement.exe is an abusable, signed PowerShell host executable that was introduced in Windows 10 and Server 2019 (OS Build 17763.1339).
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md
    - https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1
tags:
    - attack.defense_evasion
    - attack.t1218
logsource:
    product: windows
    service: powershell
    definition: Module Logging must be enabled
detection:
    selection_id:
        EventID: 4103
    selection_cmd:
        ContextInfo|contains: 'Invoke-ATHRemoteFXvGPUDisablementCommand '
    selection_opt:
        ContextInfo|contains:
            - '-ModuleName '
            - '-ModulePath '
            - '-ScriptBlock '
            - '-RemoteFXvGPUDisablementFilePath'
    condition: selection_id and selection_cmd and selection_opt
fields:
    - ComputerName
    - User
    - CommandLine
    - ParentCommandLine
falsepositives:
    - Unknown
level: medium
$frack113$ add win_susp_athremotefxvgpudisablementcommand.yml 2021-07-13 14:29:00 +02:00			`title: Abusable Invoke-ATHRemoteFXvGPUDisablementCommand`
$frack113$ Split global rules 2021-09-07 13:30:32 +02:00			`id: 38a7625e-b2cb-485d-b83d-aff137d859f4`
$frack113$ add win_susp_athremotefxvgpudisablementcommand.yml 2021-07-13 14:29:00 +02:00			`status: experimental`
			`author: frack113`
			`date: 2021/07/13`
$frack113$ Split global rules 2021-09-07 13:30:32 +02:00			`modified: 2021/09/07`
$frack113$ add win_susp_athremotefxvgpudisablementcommand.yml 2021-07-13 14:29:00 +02:00			`description: RemoteFXvGPUDisablement.exe is an abusable, signed PowerShell host executable that was introduced in Windows 10 and Server 2019 (OS Build 17763.1339).`
			`references:`
			`- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218/T1218.md`
			`- https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1`
			`tags:`
			`- attack.defense_evasion`
			`- attack.t1218`
			`logsource:`
			`product: windows`
			`service: powershell`
$frack113$ Split global rules 2021-09-07 13:30:32 +02:00			`definition: Module Logging must be enabled`
$frack113$ add win_susp_athremotefxvgpudisablementcommand.yml 2021-07-13 14:29:00 +02:00			`detection:`
$frack113$ Split global rules 2021-09-07 13:30:32 +02:00			`selection_id:`
			`EventID: 4103`
$frack113$ add win_susp_athremotefxvgpudisablementcommand.yml 2021-07-13 14:29:00 +02:00			`selection_cmd:`
			`ContextInfo\|contains: 'Invoke-ATHRemoteFXvGPUDisablementCommand '`
			`selection_opt:`
			`ContextInfo\|contains:`
			`- '-ModuleName '`
			`- '-ModulePath '`
			`- '-ScriptBlock '`
			`- '-RemoteFXvGPUDisablementFilePath'`
$frack113$ Split global rules 2021-09-07 13:30:32 +02:00			`condition: selection_id and selection_cmd and selection_opt`
			`fields:`
			`- ComputerName`
			`- User`
			`- CommandLine`
			`- ParentCommandLine`
			`falsepositives:`
			`- Unknown`
			`level: medium`