Possible Replace Desktop Wallpaper by Powershell (via ps_script)

title: Possible Replace Desktop Wallpaper by Powershell (via ps_script)
id: 63901ec6-39a0-537b-a31d-309fb1b81a50
status: stable
description: This rule detects an adversary may deface systems internal to an organization seeking to intimidate or mislead users. This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper
references:
    - https://attack.mitre.org/techniques/T1491/001/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1491.001/T1491.001.md
author: Huntrule Team
date: 2026-01-28
tags:
    - attack.impact
    - attack.t1491.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection_1:
        ScriptBlockText|contains|all:
            - 'Get-ItemProperty'
            - 'Registry::'
            - 'HKEY_CURRENT_USER\Control Panel\Desktop\'
            - 'WallPaper'
    selection_2:
        ScriptBlockText|contains: SystemParametersInfo(20,0,*,3)
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: low