1200KM / sigma-rule
Remote File Download Via Desktopimgdownldr Utility — Sigma Rule
Sigma rule 214641c2-c579-4ecb-8427-0cf19df6842e. Remote File Download Via Desktopimgdownldr Utility — Sigma Rule. Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil.
Rule metadata and linked tags
Author: Tim Rauch, Elastic (idea). Source status: test; severity: medium. Source dates: 2022-09-27 / not supplied.
{
"category": "process_creation",
"product": "windows"
}Pinned original Sigma rule · Detection Rule License 1.1
Source SHA-256: e94c5d4fd053ac15551bbf14aae878c0be5f1c96a422b114e68164f0c87df824
Detection logic
Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.
title: Remote File Download Via Desktopimgdownldr Utility
id: 214641c2-c579-4ecb-8427-0cf19df6842e
status: test
description: Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil.
references:
- https://www.elastic.co/guide/en/security/current/remote-file-download-via-desktopimgdownldr-utility.html
author: Tim Rauch, Elastic (idea)
date: 2022-09-27
tags:
- attack.command-and-control
- attack.t1105
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: '\desktopimgdownldr.exe'
ParentImage|endswith: '\desktopimgdownldr.exe'
CommandLine|contains: '/lockscreenurl:http'
condition: selection
falsepositives:
- Unknown
level: medium
False positives
- Unknown
Source references
Connected ecosystem references
Exact source-tagged techniques
Telemetry review
Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.