{"id":"81315b50-6b60-4d8f-9928-3466e1022515","title":"Desktop.INI Created by Uncommon Process","description":"Detects unusual processes accessing desktop.ini, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.","author":"Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO)","status":"test","level":"medium","date":"2020-03-19","modified":"2025-12-09","tags":["attack.privilege-escalation","attack.persistence","attack.t1547.009"],"technique_ids":["T1547.009"],"logsource":{"product":"windows","category":"file_event"},"falsepositives":["Operations performed through Windows SCCM or equivalent","Read only access list authority"],"references":["https://isc.sans.edu/forums/diary/Desktopini+as+a+postexploitation+tool/25912/"],"source_path":"rules/windows/file/file_event/file_event_win_desktop_ini_created_by_uncommon_process.yml","source_sha256":"158e6e85c4021ca05ef25e3b4c4d8ddbba750e2ffc2b1fea32a8ce621c957073","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_desktop_ini_created_by_uncommon_process.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Desktop.INI Created by Uncommon Process\nid: 81315b50-6b60-4d8f-9928-3466e1022515\nstatus: test\ndescription: Detects unusual processes accessing desktop.ini, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.\nreferences:\n    - https://isc.sans.edu/forums/diary/Desktopini+as+a+postexploitation+tool/25912/\nauthor: Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO)\ndate: 2020-03-19\nmodified: 2025-12-09\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.t1547.009\nlogsource:\n    product: windows\n    category: file_event\ndetection:\n    selection:\n        TargetFilename|endswith: '\\desktop.ini'\n    filter_main_generic:\n        Image|startswith:\n            - 'C:\\Windows\\'\n            - 'C:\\Program Files\\'\n            - 'C:\\Program Files (x86)\\'\n    filter_main_upgrade:\n        TargetFilename|startswith: 'C:\\$WINDOWS.~BT\\NewOS\\'\n    filter_optional_jetbrains:\n        Image|startswith: 'C:\\Users\\'\n        Image|endswith: '\\AppData\\Local\\JetBrains\\Toolbox\\bin\\7z.exe'\n        TargetFilename|contains: '\\JetBrains\\apps\\'\n    filter_optional_onedrive:\n        Image|startswith: 'C:\\Users\\'\n        Image|contains: '\\AppData\\Local\\Microsoft\\OneDrive\\'\n    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Operations performed through Windows SCCM or equivalent\n    - Read only access list authority\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1547.009","id":"T1547.009","name":"Shortcut Modification","page":"techniques/enterprise/T1547.009/"}],"data_path":"data/detection-rules/81315b50-6b60-4d8f-9928-3466e1022515.json","kind":"sigma"}