{"id":"85b88e05-dadc-430b-8a9e-53ff1cd30aae","title":"Potentially Suspicious Desktop Background Change Via Registry","description":"Detects registry value settings that would replace the user's desktop background.\nThis is a common technique used by malware to change the desktop background to a ransom note or other image.\n","author":"Nasreddine Bencherchali (Nextron Systems), Stephen Lincoln @slincoln-aiq (AttackIQ)","status":"test","level":"medium","date":"2023-12-21","modified":"2025-10-17","tags":["attack.persistence","attack.impact","attack.defense-impairment","attack.t1112","attack.t1491.001"],"technique_ids":["T1112","T1491.001"],"logsource":{"product":"windows","category":"registry_set"},"falsepositives":["Administrative scripts that change the desktop background to a company logo or other image."],"references":["https://www.attackiq.com/2023/09/20/emulating-rhysida/","https://research.checkpoint.com/2023/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/","https://www.trendmicro.com/en_us/research/23/h/an-overview-of-the-new-rhysida-ransomware.html","https://www.virustotal.com/gui/file/a864282fea5a536510ae86c77ce46f7827687783628e4f2ceb5bf2c41b8cd3c6/behavior","https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsDesktop::Wallpaper","https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.ControlPanelDisplay::CPL_Personalization_NoDesktopBackgroundUI"],"source_path":"rules/windows/registry/registry_set/registry_set_desktop_background_change.yml","source_sha256":"4ab5dfe8d7c8d129999ba2cbde5dae4f6aa4da1055bd66506133109f67275487","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_desktop_background_change.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potentially Suspicious Desktop Background Change Via Registry\nid: 85b88e05-dadc-430b-8a9e-53ff1cd30aae\nrelated:\n    - id: 8cbc9475-8d05-4e27-9c32-df960716c701\n      type: similar\nstatus: test\ndescription: |\n    Detects registry value settings that would replace the user's desktop background.\n    This is a common technique used by malware to change the desktop background to a ransom note or other image.\nreferences:\n    - https://www.attackiq.com/2023/09/20/emulating-rhysida/\n    - https://research.checkpoint.com/2023/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/\n    - https://www.trendmicro.com/en_us/research/23/h/an-overview-of-the-new-rhysida-ransomware.html\n    - https://www.virustotal.com/gui/file/a864282fea5a536510ae86c77ce46f7827687783628e4f2ceb5bf2c41b8cd3c6/behavior\n    - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsDesktop::Wallpaper\n    - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.ControlPanelDisplay::CPL_Personalization_NoDesktopBackgroundUI\nauthor: Nasreddine Bencherchali (Nextron Systems), Stephen Lincoln @slincoln-aiq (AttackIQ)\ndate: 2023-12-21\nmodified: 2025-10-17\ntags:\n    - attack.persistence\n    - attack.impact\n    - attack.defense-impairment\n    - attack.t1112\n    - attack.t1491.001\nlogsource:\n    product: windows\n    category: registry_set\ndetection:\n    selection_keys:\n        TargetObject|contains:\n            - 'Control Panel\\Desktop'\n            - 'CurrentVersion\\Policies\\ActiveDesktop'\n            - 'CurrentVersion\\Policies\\System'\n    selection_values_1:\n        TargetObject|endswith: 'NoChangingWallpaper'\n        Details: 'DWORD (0x00000001)' # Prevent changing desktop background\n    selection_values_2:\n        TargetObject|endswith: '\\Wallpaper'\n    selection_values_3:\n        TargetObject|endswith: '\\WallpaperStyle'\n        Details: '2' # Stretch\n    filter_main_svchost:\n        # Note: Excluding GPO changes\n        Image|endswith: '\\svchost.exe'\n    filter_main_empty:\n        TargetObject|endswith: '\\Control Panel\\Desktop\\Wallpaper'\n        Details: '(Empty)'\n    filter_main_explorer:\n        # Normally Explorer.exe is the process that changes the desktop background\n        Image|endswith: 'C:\\Windows\\Explorer.EXE'\n    filter_optional_ec2launch:\n        Image:\n            - 'C:\\Program Files\\Amazon\\EC2Launch\\EC2Launch.exe'\n            - 'C:\\Program Files (x86)\\Amazon\\EC2Launch\\EC2Launch.exe'\n        TargetObject|endswith: '\\Control Panel\\Desktop\\Wallpaper'\n    condition: selection_keys and 1 of selection_values_* and not 1 of filter_main_* and not 1 of filter_optional_*\nfalsepositives:\n    - Administrative scripts that change the desktop background to a company logo or other image.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1112","id":"T1112","name":"Modify Registry","page":"techniques/enterprise/T1112/"},{"key":"enterprise/T1491.001","id":"T1491.001","name":"Internal Defacement","page":"techniques/enterprise/T1491.001/"}],"data_path":"data/detection-rules/85b88e05-dadc-430b-8a9e-53ff1cd30aae.json","kind":"sigma"}