Sigma rule: Potentially Suspicious Desktop Background Change Using Reg.EXE

Rule

Title

Potentially Suspicious Desktop Background Change Using Reg.EXE

Status

test

Level

medium

Author

Stephen Lincoln @slincoln-aiq (AttackIQ)

Date

2023-12-21

File

rules/windows/process_creation/proc_creation_win_reg_desktop_background_change.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of "reg.exe" to alter registry keys that would replace the user's desktop background.
This is a common technique used by malware to change the desktop background to a ransom note or other image.

Log source

product

windows

category

process_creation

Detection

# TODO: Improve this to also focus on variation using PowerShell and other CLI tools
selection_reg_img:
    - Image|endswith: '\reg.exe'
    - OriginalFileName: 'reg.exe'
selection_reg_flag:
    CommandLine|contains: 'add'
selection_keys:
    CommandLine|contains:
        - 'Control Panel\Desktop'
        - 'CurrentVersion\Policies\ActiveDesktop'
        - 'CurrentVersion\Policies\System'
selection_cli_reg_1:
    CommandLine|contains|all:
        - '/v NoChangingWallpaper'
        - '/d 1' # Prevent changing desktop background
selection_cli_reg_2:
    CommandLine|contains|all:
        - '/v Wallpaper'
        - '/t REG_SZ'
selection_cli_reg_3:
    CommandLine|contains|all:
        - '/v WallpaperStyle'
        - '/d 2' # Stretch
condition: all of selection_reg_* and selection_keys and 1 of selection_cli_reg_*

False positives (as the rule lists them)

• Administrative scripts that change the desktop background to a company logo or other image.

Tags

• attack.persistence
• attack.impact
• attack.defense-impairment
• attack.t1112
• attack.t1491.001

MITRE ATT&CK ids this rule names

• T1112
• T1491.001

Related rules

• 85b88e05-dadc-430b-8a9e-53ff1cd30aae (similar)

References

• https://www.attackiq.com/2023/09/20/emulating-rhysida/
• https://research.checkpoint.com/2023/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/
• https://www.trendmicro.com/en_us/research/23/h/an-overview-of-the-new-rhysida-ransomware.html
• https://www.virustotal.com/gui/file/a864282fea5a536510ae86c77ce46f7827687783628e4f2ceb5bf2c41b8cd3c6/behavior
• https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsDesktop::Wallpaper
• https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.ControlPanelDisplay::CPL_Personalization_NoDesktopBackgroundUI

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_reg_desktop_background_change.yml