Windows Network Access Suspicious desktop.ini Action (via security)

title: Windows Network Access Suspicious desktop.ini Action (via security)
id: 7a47289f-4182-51f4-8068-c5ab898ab638
status: stable
description: This rule detects unusual processes accessing desktop.ini remotely over network share, that can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.
references:
    - https://attack.mitre.org/techniques/T1547/009/
    - https://isc.sans.edu/forums/diary/Desktopini+as+a+postexploitation+tool/25912/
author: Huntrule Team
date: 2026-01-13
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1547.009
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5145
        ObjectType: File
        RelativeTargetName|endswith: '\desktop.ini'
        AccessList|contains:
            - 'WriteData'
            - 'DELETE'
            - 'WriteDAC'
            - 'AppendData'
            - 'AddSubdirectory'
    condition: selection
falsepositives:
    - Unknown
level: medium