Merge pull request #3876 from frack113/fix_fp_gfx

Update proc_creation_win_susp_file_download_via_gfxdownloadwrapper.yml
2023-01-06 13:48:31 +01:00
parent d3a5a095d4 31530e50b7
commit 65eb06e231
1 changed files with 4 additions and 2 deletions
@@ -6,7 +6,7 @@ references:
    - https://lolbas-project.github.io/lolbas/Binaries/GfxDownloadWrapper/
 author: Victor Sergeev, oscd.community
 date: 2020/10/09
-modified: 2021/11/27
+modified: 2022/01/06
 tags:
    - attack.command_and_control
    - attack.t1105
@@ -18,7 +18,9 @@ detection:
        Image|endswith: '\GfxDownloadWrapper.exe'
    filter:
        CommandLine|contains: 'gameplayapi.intel.com'
-        ParentImage|endswith: '\GfxDownloadWrapper.exe'
+        ParentImage|endswith: 
+            - '\GfxDownloadWrapper.exe'
+            - '\igfxEM.exe'
    condition: image_path and not filter
 fields:
    - CommandLine