{"id":"8cbc9475-8d05-4e27-9c32-df960716c701","title":"Potentially Suspicious Desktop Background Change Using Reg.EXE","description":"Detects the execution of \"reg.exe\" to alter registry keys that would replace the user's desktop background.\nThis is a common technique used by malware to change the desktop background to a ransom note or other image.\n","author":"Stephen Lincoln @slincoln-aiq (AttackIQ)","status":"test","level":"medium","date":"2023-12-21","modified":"","tags":["attack.persistence","attack.impact","attack.defense-impairment","attack.t1112","attack.t1491.001"],"technique_ids":["T1112","T1491.001"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Administrative scripts that change the desktop background to a company logo or other image."],"references":["https://www.attackiq.com/2023/09/20/emulating-rhysida/","https://research.checkpoint.com/2023/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/","https://www.trendmicro.com/en_us/research/23/h/an-overview-of-the-new-rhysida-ransomware.html","https://www.virustotal.com/gui/file/a864282fea5a536510ae86c77ce46f7827687783628e4f2ceb5bf2c41b8cd3c6/behavior","https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsDesktop::Wallpaper","https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.ControlPanelDisplay::CPL_Personalization_NoDesktopBackgroundUI"],"source_path":"rules/windows/process_creation/proc_creation_win_reg_desktop_background_change.yml","source_sha256":"ba2c20fb71af764a2acdf127c6d81b98a7fba37129bceca75d9efc6bc3c9b050","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_desktop_background_change.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potentially Suspicious Desktop Background Change Using Reg.EXE\nid: 8cbc9475-8d05-4e27-9c32-df960716c701\nrelated:\n    - id: 85b88e05-dadc-430b-8a9e-53ff1cd30aae\n      type: similar\nstatus: test\ndescription: |\n    Detects the execution of \"reg.exe\" to alter registry keys that would replace the user's desktop background.\n    This is a common technique used by malware to change the desktop background to a ransom note or other image.\nreferences:\n    - https://www.attackiq.com/2023/09/20/emulating-rhysida/\n    - https://research.checkpoint.com/2023/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/\n    - https://www.trendmicro.com/en_us/research/23/h/an-overview-of-the-new-rhysida-ransomware.html\n    - https://www.virustotal.com/gui/file/a864282fea5a536510ae86c77ce46f7827687783628e4f2ceb5bf2c41b8cd3c6/behavior\n    - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsDesktop::Wallpaper\n    - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.ControlPanelDisplay::CPL_Personalization_NoDesktopBackgroundUI\nauthor: Stephen Lincoln @slincoln-aiq (AttackIQ)\ndate: 2023-12-21\ntags:\n    - attack.persistence\n    - attack.impact\n    - attack.defense-impairment\n    - attack.t1112\n    - attack.t1491.001\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    # TODO: Improve this to also focus on variation using PowerShell and other CLI tools\n    selection_reg_img:\n        - Image|endswith: '\\reg.exe'\n        - OriginalFileName: 'reg.exe'\n    selection_reg_flag:\n        CommandLine|contains: 'add'\n    selection_keys:\n        CommandLine|contains:\n            - 'Control Panel\\Desktop'\n            - 'CurrentVersion\\Policies\\ActiveDesktop'\n            - 'CurrentVersion\\Policies\\System'\n    selection_cli_reg_1:\n        CommandLine|contains|all:\n            - '/v NoChangingWallpaper'\n            - '/d 1' # Prevent changing desktop background\n    selection_cli_reg_2:\n        CommandLine|contains|all:\n            - '/v Wallpaper'\n            - '/t REG_SZ'\n    selection_cli_reg_3:\n        CommandLine|contains|all:\n            - '/v WallpaperStyle'\n            - '/d 2' # Stretch\n    condition: all of selection_reg_* and selection_keys and 1 of selection_cli_reg_*\nfalsepositives:\n    - Administrative scripts that change the desktop background to a company logo or other image.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1112","id":"T1112","name":"Modify Registry","page":"techniques/enterprise/T1112/"},{"key":"enterprise/T1491.001","id":"T1491.001","name":"Internal Defacement","page":"techniques/enterprise/T1491.001/"}],"data_path":"data/detection-rules/8cbc9475-8d05-4e27-9c32-df960716c701.json","kind":"sigma"}