Windows Desktop.ini Accessed by Uncommon Process

title: Windows Desktop.ini Accessed by Uncommon Process
id: 9cdb620b-e700-4d2f-b800-9a97002e7940
status: test
description: This rule flags file events where a process other than common system and installer paths accesses or targets a Desktop.ini file (ending with \desktop.ini). Attackers can use Desktop.ini to influence how Windows Explorer presents folder contents, which can support deceptive file renaming without modifying the underlying files. It relies on Windows file event telemetry that includes the process image path (Image) and the targeted filename (TargetFilename).
references:
  - https://isc.sans.edu/forums/diary/Desktopini+as+a+postexploitation+tool/25912/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_desktop_ini_created_by_uncommon_process.yml
author: Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO), Huntrule Team
date: 2020-03-19
modified: 2025-12-09
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.009
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith: \desktop.ini
  filter_main_generic:
    Image|startswith:
      - C:\Windows\
      - C:\Program Files\
      - C:\Program Files (x86)\
  filter_main_upgrade:
    TargetFilename|startswith: C:\$WINDOWS.~BT\NewOS\
  filter_optional_jetbrains:
    Image|startswith: C:\Users\
    Image|endswith: \AppData\Local\JetBrains\Toolbox\bin\7z.exe
    TargetFilename|contains: \JetBrains\apps\
  filter_optional_onedrive:
    Image|startswith: C:\Users\
    Image|contains: \AppData\Local\Microsoft\OneDrive\
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - Operations performed through Windows SCCM or equivalent
  - Read only access list authority
level: medium
license: DRL-1.1
related:
  - id: 81315b50-6b60-4d8f-9928-3466e1022515
    type: derived