Detection rules › Sigma

Potentially Suspicious Desktop Background Change Via Registry

Severity
medium
Author
Nasreddine Bencherchali (Nextron Systems), Stephen Lincoln @slincoln-aiq (AttackIQ)
Source
upstream

Detects registry value settings that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1112 Modify Registry
Defense EvasionT1112 Modify Registry
ImpactT1491.001 Defacement: Internal Defacement

Event coverage

ProviderEvent IDTitle
Sysmon13RegistryEvent (Value Set)

Stages and Predicates

Stage 1: selection_keys

or:
TargetObject|contains: 'Control Panel\Desktop'
TargetObject|contains: 'CurrentVersion\Policies\ActiveDesktop'
TargetObject|contains: 'CurrentVersion\Policies\System'

Stage 2: 1 of selection_values_1

Details: 'DWORD (0x00000001)'
TargetObject|endswith: NoChangingWallpaper

Stage 3: 1 of selection_values_2

TargetObject|endswith: '\Wallpaper'

Stage 4: 1 of selection_values_3

Details: 2
TargetObject|endswith: '\WallpaperStyle'

Stage 5: not 1 of filter_main_*

or:
Details: '(Empty)'
TargetObject|endswith: '\Control Panel\Desktop\Wallpaper'
Image|endswith: 'C:\Windows\Explorer.EXE'
Image|endswith: '\svchost.exe'

Stage 6: not 1 of filter_optional_ec2launch

Image: ['C:\Program Files (x86)\Amazon\EC2Launch\EC2Launch.exe', 'C:\Program Files\Amazon\EC2Launch\EC2Launch.exe']
TargetObject|endswith: '\Control Panel\Desktop\Wallpaper'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Detailseq
  • (Empty) corpus 24 (sigma 24)
  • 2
  • DWORD (0x00000001) corpus 37 (sigma 37)
Imageends_with
  • C:\Windows\Explorer.EXE
  • \svchost.exe corpus 20 (sigma 20)
Imageeq
  • C:\Program Files (x86)\Amazon\EC2Launch\EC2Launch.exe
  • C:\Program Files\Amazon\EC2Launch\EC2Launch.exe
TargetObjectends_with
  • NoChangingWallpaper
  • \Control Panel\Desktop\Wallpaper
  • \Wallpaper
  • \WallpaperStyle
TargetObjectmatch
  • Control Panel\Desktop
  • CurrentVersion\Policies\ActiveDesktop
  • CurrentVersion\Policies\System