Windows PowerShell Wallpaper Replacement via Registry and SystemParametersInfo
Identifies PowerShell script blocks that modify the HKCU Desktop\WallPaper setting to replace a user’s wallpaper.
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-12-26
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule identifies PowerShell script activity that reads the current user desktop wallpaper from the registry and calls the Windows API function SystemParametersInfo with parameters consistent with changing the desktop wallpaper. Defacement tactics like this can intimidate or mislead users and may be used to visually persist an attacker’s message on compromised endpoints. It relies on Script Block Logging telemetry capturing PowerShell ScriptBlockText containing the relevant registry keys/values and the SystemParametersInfo(20,0,*,3) call pattern.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell Wallpaper Replacement via Registry and SystemParametersInfo
id: e5353e96-34d6-4c17-bd21-9acb5f58b7be
status: test
description: This rule identifies PowerShell script activity that reads the current user desktop wallpaper from the registry and calls the Windows API function SystemParametersInfo with parameters consistent with changing the desktop wallpaper. Defacement tactics like this can intimidate or mislead users and may be used to visually persist an attacker’s message on compromised endpoints. It relies on Script Block Logging telemetry capturing PowerShell ScriptBlockText containing the relevant registry keys/values and the SystemParametersInfo(20,0,*,3) call pattern.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1491.001/T1491.001.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_wallpaper.yml
author: frack113, Huntrule Team
date: 2021-12-26
tags:
- attack.impact
- attack.t1491.001
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection_1:
ScriptBlockText|contains|all:
- Get-ItemProperty
- "Registry::"
- HKEY_CURRENT_USER\Control Panel\Desktop\
- WallPaper
selection_2:
ScriptBlockText|contains: SystemParametersInfo(20,0,*,3)
condition: 1 of selection_*
falsepositives:
- Unknown
level: low
license: DRL-1.1
related:
- id: c5ac6a1e-9407-45f5-a0ce-ca9a0806a287
type: derived