Windows reg.exe Changes Desktop Background Policy Values

Alerts when reg.exe is used to modify Windows registry settings that control wallpaper or desktop background behavior.

FreeUnreviewedSigmamediumv1

windows-reg-exe-changes-desktop-background-policy-values-8cbc9475

title: Windows reg.exe Changes Desktop Background Policy Values
id: 0be71202-4798-4681-8b7e-c563b6a0ebe0
related:
  - id: 85b88e05-dadc-430b-8a9e-53ff1cd30aae
    type: similar
  - id: 8cbc9475-8d05-4e27-9c32-df960716c701
    type: derived
status: test
description: This rule flags process executions of reg.exe with command lines containing registry modifications related to desktop background and wallpaper settings. Attackers can use these changes to disrupt user visibility or influence what the user sees on the desktop, such as displaying ransom-style imagery or impairing normal use. It relies on Windows process creation telemetry, matching reg.exe invocation with specific registry key paths and policy/value parameters.
references:
  - https://www.attackiq.com/2023/09/20/emulating-rhysida/
  - https://research.checkpoint.com/2023/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/
  - https://www.trendmicro.com/en_us/research/23/h/an-overview-of-the-new-rhysida-ransomware.html
  - https://www.virustotal.com/gui/file/a864282fea5a536510ae86c77ce46f7827687783628e4f2ceb5bf2c41b8cd3c6/behavior
  - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsDesktop::Wallpaper
  - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.ControlPanelDisplay::CPL_Personalization_NoDesktopBackgroundUI
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_desktop_background_change.yml
author: Stephen Lincoln @slincoln-aiq (AttackIQ), Huntrule Team
date: 2023-12-21
tags:
  - attack.persistence
  - attack.impact
  - attack.defense-impairment
  - attack.t1112
  - attack.t1491.001
logsource:
  product: windows
  category: process_creation
detection:
  selection_reg_img:
    - Image|endswith: \reg.exe
    - OriginalFileName: reg.exe
  selection_reg_flag:
    CommandLine|contains: add
  selection_keys:
    CommandLine|contains:
      - Control Panel\Desktop
      - CurrentVersion\Policies\ActiveDesktop
      - CurrentVersion\Policies\System
  selection_cli_reg_1:
    CommandLine|contains|all:
      - /v NoChangingWallpaper
      - /d 1
  selection_cli_reg_2:
    CommandLine|contains|all:
      - /v Wallpaper
      - /t REG_SZ
  selection_cli_reg_3:
    CommandLine|contains|all:
      - /v WallpaperStyle
      - /d 2
  condition: all of selection_reg_* and selection_keys and 1 of selection_cli_reg_*
falsepositives:
  - Administrative scripts that change the desktop background to a company logo or other image.
level: medium
license: DRL-1.1

What it detects

This rule flags process executions of reg.exe with command lines containing registry modifications related to desktop background and wallpaper settings. Attackers can use these changes to disrupt user visibility or influence what the user sees on the desktop, such as displaying ransom-style imagery or impairing normal use. It relies on Windows process creation telemetry, matching reg.exe invocation with specific registry key paths and policy/value parameters.

Known false positives

Administrative scripts that change the desktop background to a company logo or other image.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.