Windows desktop.ini file creation/access by unusual process

title: Windows desktop.ini file creation/access by unusual process
id: 9cdb620b-e700-4d2f-b800-9a97002e7940
status: test
description: This rule flags file events where a non-system, potentially suspicious process accesses or creates a Desktop.ini file in a folder. Attackers can use Desktop.ini to influence Windows Explorer’s folder display behavior, which can help disguise or rename items without modifying the underlying file contents. The detection relies on Windows file event telemetry that includes the target filename (ending in \desktop.ini) and the initiating process image path for filtering known common locations and exceptions.
references:
  - https://isc.sans.edu/forums/diary/Desktopini+as+a+postexploitation+tool/25912/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_desktop_ini_created_by_uncommon_process.yml
author: Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO), Huntrule Team
date: 2020-03-19
modified: 2025-12-09
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.009
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith: \desktop.ini
  filter_main_generic:
    Image|startswith:
      - C:\Windows\
      - C:\Program Files\
      - C:\Program Files (x86)\
  filter_main_upgrade:
    TargetFilename|startswith: C:\$WINDOWS.~BT\NewOS\
  filter_optional_jetbrains:
    Image|startswith: C:\Users\
    Image|endswith: \AppData\Local\JetBrains\Toolbox\bin\7z.exe
    TargetFilename|contains: \JetBrains\apps\
  filter_optional_onedrive:
    Image|startswith: C:\Users\
    Image|contains: \AppData\Local\Microsoft\OneDrive\
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Operations performed through Windows SCCM or equivalent
  - Read only access list authority
level: medium
license: DRL-1.1
related:
  - id: 81315b50-6b60-4d8f-9928-3466e1022515
    type: derived