Query: detect Detects registry value settings that would replace the user's desktop background. This is a common technique used by mal in logs
Matching passage: Sigma rule: Detects registry value settings that would replace the user's desktop background. This is a common technique used by mal. Logsource: windows / registry_set. Rule: title: Potentially Suspicious Desktop Background Change Via Registry id: 85b88e05-dadc-430b-8a9e-53ff1cd30aae related: - id: 8cbc9475-8d05-4e27-9c32-df960716c701 type: similar status: test description: 'Detects registry value settings that would replace the user''s desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image. ' references: - https://www.attackiq.com/2023/09/20/emulating-rhysida/ - https://research.checkpoint.com/2023/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/ - https://www.trendmicro.com/en_us/research/23/h/an-overview-of-the-new-rhysida-ransomware.html - https://www.virustotal.com/gui/file/a864282fea5a536510ae86c77ce46f7827687783628e4f2ceb5bf2c41b8cd3c6/behavior - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsDesktop::Wallpaper - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.ControlPanelDisplay::CPL_Personalization_NoDesktopBackgroundUI author: Nasreddine Bencherchali (Nextron Systems), Stephen Lincoln @slincoln-aiq (AttackIQ) date: 2023-12-21 modified: 2025-10-17 tags: - attack.persistence - attack.impact - attack.defense-impairment - attack.t1112 - attack.t1491.001 logsource: product: windows category: registry_set detection: selection_keys: TargetObject|contains: - Control Panel\Desktop - CurrentVersion\Policies\ActiveDesktop - CurrentVersion\Policies\System selection_values_1: TargetObject|endswith: NoChangingWallpaper Details: DWORD (0x00000001) selection_values_2: TargetObject|endswith: \Wallpaper selection_values_3: TargetObject|endswith: \WallpaperStyle Details: '2' filter_main_svchost: Image|endswith: \svchost.exe filter_main_empty: TargetObject|endswith: \Control Panel\Desktop\Wallpaper Details: (Empty) filter_main_explorer: Image|endswith: C:\Windows\Explorer.EXE filter_optional_ec2launch: Image: - C:\Program Files\Amazon\EC2Launch\EC2Launch.exe - C:\Program Files (x86)\Amazon\EC2Launch\EC2Launch.exe TargetObject|endswith: \Control Panel\Desktop\Wallpaper condition: selection_keys and 1 of selection_values_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Administrative scripts that change the desktop background to a company logo or other image. level: medium
Near-miss passage: Sigma rule: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently acc. Logsource: windows / process_creation. Rule: title: System Network Connections Discovery Via Net.EXE id: 1c67a717-32ba-409b-a45d-0fb704a73a81 status: test description: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-1---system-network-connections-discovery author: frack113 date: 2021-12-10 modified: 2023-02-21 tags: - attack.discovery - attack.t1049 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: - CommandLine|endswith: - ' use' - ' sessions' - CommandLine|contains: - ' use ' - ' sessions ' condition: all of selection_* falsepositives: - Unknown level: low