Desktop.INI Created by Unusual Process (via file_event)

title: Desktop.INI Created by Unusual Process (via file_event)
id: 9cebe3cf-f55c-5254-b638-af442ce03dee
status: stable
description: This rule detects unusual processes accessing desktop.ini, that can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.
references:
    - https://attack.mitre.org/techniques/T1547/009/
    - https://isc.sans.edu/forums/diary/Desktopini+as+a+postexploitation+tool/25912/
author: Huntrule Team
date: 2026-02-15
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1547.009
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|endswith: '\desktop.ini'
    filter_main_generic:
        Image|startswith:
            - 'C:\Windows\'
            - 'C:\Program Files\'
            - 'C:\Program Files (x86)\'
    filter_main_upgrade:
        TargetFilename|startswith: 'C:\$WINDOWS.~BT\NewOS\'
    filter_optional_jetbrains:
        Image|startswith: 'C:\Users\'
        Image|endswith: '\AppData\Local\JetBrains\Toolbox\bin\7z.exe'
        TargetFilename|contains: '\JetBrains\apps\'
    filter_optional_onedrive:
        Image|startswith: 'C:\Users\'
        Image|contains: '\AppData\Local\Microsoft\OneDrive\'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: medium