RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses

SigmaHQ Detections@sigmaHQ

•updated May 15, 2023•0•0•0

Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "RemoteFXvGPUDisablement.exe" binary to run custom PowerShell code via module load-order hijacking.