{"id":"c5ac6a1e-9407-45f5-a0ce-ca9a0806a287","title":"Replace Desktop Wallpaper by Powershell","description":"An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users.\nThis may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper\n","author":"frack113","status":"test","level":"low","date":"2021-12-26","modified":"","tags":["attack.impact","attack.t1491.001"],"technique_ids":["T1491.001"],"logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"falsepositives":["Unknown"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1491.001/T1491.001.md"],"source_path":"rules/windows/powershell/powershell_script/posh_ps_susp_wallpaper.yml","source_sha256":"66ead16a3b97a58d32f2c6e5acf2c3a0244e722abdb6b2c6f5d2c9d4b8a66048","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_susp_wallpaper.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Replace Desktop Wallpaper by Powershell\nid: c5ac6a1e-9407-45f5-a0ce-ca9a0806a287\nstatus: test\ndescription: |\n    An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users.\n    This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1491.001/T1491.001.md\nauthor: frack113\ndate: 2021-12-26\ntags:\n    - attack.impact\n    - attack.t1491.001\nlogsource:\n    product: windows\n    category: ps_script\n    definition: 'Requirements: Script Block Logging must be enabled'\ndetection:\n    selection_1:\n        ScriptBlockText|contains|all:\n            - 'Get-ItemProperty'\n            - 'Registry::'\n            - 'HKEY_CURRENT_USER\\Control Panel\\Desktop\\'\n            - 'WallPaper'\n    selection_2:\n        ScriptBlockText|contains: SystemParametersInfo(20,0,*,3)\n    condition: 1 of selection_*\nfalsepositives:\n    - Unknown\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1491.001","id":"T1491.001","name":"Internal Defacement","page":"techniques/enterprise/T1491.001/"}],"data_path":"data/detection-rules/c5ac6a1e-9407-45f5-a0ce-ca9a0806a287.json","kind":"sigma"}