Windows Desktop.ini Accessed by Uncommon Process
Alerts when unexpected processes create or access Desktop.ini, which can be abused to change how Explorer displays folder contents.
- Product
- windows
- Category
- file_event
- Author
- Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO) (SigmaHQ), DRL 1.1
- Published
- 2020-03-19
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags file events where a process other than common system and installer paths accesses or targets a Desktop.ini file (ending with \desktop.ini). Attackers can use Desktop.ini to influence how Windows Explorer presents folder contents, which can support deceptive file renaming without modifying the underlying files. It relies on Windows file event telemetry that includes the process image path (Image) and the targeted filename (TargetFilename).
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Desktop.ini Accessed by Uncommon Process
id: 9cdb620b-e700-4d2f-b800-9a97002e7940
status: test
description: This rule flags file events where a process other than common system and installer paths accesses or targets a Desktop.ini file (ending with \desktop.ini). Attackers can use Desktop.ini to influence how Windows Explorer presents folder contents, which can support deceptive file renaming without modifying the underlying files. It relies on Windows file event telemetry that includes the process image path (Image) and the targeted filename (TargetFilename).
references:
- https://isc.sans.edu/forums/diary/Desktopini+as+a+postexploitation+tool/25912/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_desktop_ini_created_by_uncommon_process.yml
author: Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO), Huntrule Team
date: 2020-03-19
modified: 2025-12-09
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1547.009
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|endswith: \desktop.ini
filter_main_generic:
Image|startswith:
- C:\Windows\
- C:\Program Files\
- C:\Program Files (x86)\
filter_main_upgrade:
TargetFilename|startswith: C:\$WINDOWS.~BT\NewOS\
filter_optional_jetbrains:
Image|startswith: C:\Users\
Image|endswith: \AppData\Local\JetBrains\Toolbox\bin\7z.exe
TargetFilename|contains: \JetBrains\apps\
filter_optional_onedrive:
Image|startswith: C:\Users\
Image|contains: \AppData\Local\Microsoft\OneDrive\
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Operations performed through Windows SCCM or equivalent
- Read only access list authority
level: medium
license: DRL-1.1
related:
- id: 81315b50-6b60-4d8f-9928-3466e1022515
type: derived