{"id":"35bc7e28-ee6b-492f-ab04-da58fcf6402e","title":"Windows Network Access Suspicious desktop.ini Action","description":"Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.","author":"Tim Shelton (HAWK.IO)","status":"test","level":"medium","date":"2021-12-06","modified":"2022-01-16","tags":["attack.privilege-escalation","attack.persistence","attack.t1547.009"],"technique_ids":["T1547.009"],"logsource":{"product":"windows","service":"security"},"falsepositives":["Read only access list authority"],"references":["https://isc.sans.edu/forums/diary/Desktopini+as+a+postexploitation+tool/25912/"],"source_path":"rules/windows/builtin/security/win_security_net_share_obj_susp_desktop_ini.yml","source_sha256":"a9159e5cc19376051d394150d9c0e93a2e6cb7bf6aaa086a995d62d7ef3c7b15","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_net_share_obj_susp_desktop_ini.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Windows Network Access Suspicious desktop.ini Action\nid: 35bc7e28-ee6b-492f-ab04-da58fcf6402e\nstatus: test\ndescription: Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.\nreferences:\n    - https://isc.sans.edu/forums/diary/Desktopini+as+a+postexploitation+tool/25912/\nauthor: Tim Shelton (HAWK.IO)\ndate: 2021-12-06\nmodified: 2022-01-16\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.t1547.009\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection:\n        EventID: 5145\n        ObjectType: File\n        RelativeTargetName|endswith: '\\desktop.ini'\n        AccessList|contains:\n            - 'WriteData'\n            - 'DELETE'\n            - 'WriteDAC'\n            - 'AppendData'\n            - 'AddSubdirectory'\n    condition: selection\nfalsepositives:\n    - Read only access list authority\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1547.009","id":"T1547.009","name":"Shortcut Modification","page":"techniques/enterprise/T1547.009/"}],"data_path":"data/detection-rules/35bc7e28-ee6b-492f-ab04-da58fcf6402e.json","kind":"sigma"}