Windows desktopimgdownldr.exe Remote File Download Execution

title: Windows desktopimgdownldr.exe Remote File Download Execution
id: 5e0fc3cf-4321-4a2c-bbe8-26ca7a2525a5
status: test
description: This rule identifies execution of desktopimgdownldr.exe on Windows when its command line includes a remote lockscreen URL parameter. Attackers can leverage desktopimgdownldr to retrieve external content, providing an alternative remote file download mechanism. The detection relies on process creation telemetry, matching the executable path and command-line content in the spawned process.
references:
  - https://www.elastic.co/guide/en/security/current/remote-file-download-via-desktopimgdownldr-utility.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_desktopimgdownldr_remote_file_download.yml
author: Tim Rauch, Elastic (idea), Huntrule Team
date: 2022-09-27
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \desktopimgdownldr.exe
    ParentImage|endswith: \desktopimgdownldr.exe
    CommandLine|contains: /lockscreenurl:http
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 214641c2-c579-4ecb-8427-0cf19df6842e
    type: derived