Windows desktopimgdownldr Suspicious Download Parameters and Registry Deletion

Flags desktopimgdownldr command lines indicating potential external file download or personalization registry deletion.

FreeUnreviewedSigmahighv1

windows-desktopimgdownldr-suspicious-download-parameters-and-registry-deletion-bb58aa4a

title: Windows desktopimgdownldr Suspicious Download Parameters and Registry Deletion
id: 378d2c89-487e-4b45-adb9-558c9d8dff93
status: test
description: "This rule flags Microsoft desktopimgdownldr executions that include the /lockscreenurl: parameter without an image-file extension in the command line, suggesting non-image content retrieval. It also detects desktopimgdownldr command lines that include both 'reg delete' and 'PersonalizationCSP', indicating possible tampering with personalization-related registry settings. The detection relies on Windows process creation telemetry, specifically matching substrings within the process command line."
references:
  - https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/
  - https://twitter.com/SBousseaden/status/1278977301745741825
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_desktopimgdownldr_susp_execution.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-07-03
modified: 2021-11-27
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    CommandLine|contains: " /lockscreenurl:"
  selection1_filter:
    CommandLine|contains:
      - .jpg
      - .jpeg
      - .png
  selection_reg:
    CommandLine|contains|all:
      - reg delete
      - \PersonalizationCSP
  condition: ( selection1 and not selection1_filter ) or selection_reg
falsepositives:
  - False positives depend on scripts and administrative tools used in the monitored environment
level: high
license: DRL-1.1
related:
  - id: bb58aa4a-b80b-415a-a2c0-2f65a4c81009
    type: derived

What it detects

This rule flags Microsoft desktopimgdownldr executions that include the /lockscreenurl: parameter without an image-file extension in the command line, suggesting non-image content retrieval. It also detects desktopimgdownldr command lines that include both 'reg delete' and 'PersonalizationCSP', indicating possible tampering with personalization-related registry settings. The detection relies on Windows process creation telemetry, specifically matching substrings within the process command line.

Known false positives

False positives depend on scripts and administrative tools used in the monitored environment

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.