Windows PowerShell wallpaper replacement via Control Panel\Desktop registry updates

title: Windows PowerShell wallpaper replacement via Control Panel\Desktop registry updates
id: e5353e96-34d6-4c17-bd21-9acb5f58b7be
status: test
description: This rule flags PowerShell script blocks that query and write user desktop wallpaper settings in the registry under HKEY_CURRENT_USER\Control Panel\Desktop using the WallPaper value. Adversaries can use this to deface user systems and mislead or intimidate users without needing other persistence mechanisms. The detection relies on PowerShell Script Block logging telemetry capturing ScriptBlockText patterns for registry access and wallpaper API usage.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1491.001/T1491.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_wallpaper.yml
author: frack113, Huntrule Team
date: 2021-12-26
tags:
  - attack.impact
  - attack.t1491.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_1:
    ScriptBlockText|contains|all:
      - Get-ItemProperty
      - "Registry::"
      - HKEY_CURRENT_USER\Control Panel\Desktop\
      - WallPaper
  selection_2:
    ScriptBlockText|contains: SystemParametersInfo(20,0,*,3)
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: c5ac6a1e-9407-45f5-a0ce-ca9a0806a287
    type: derived