Windows Security Event 5145: Remote writes to desktop.ini via UNC share

Flags remote network-shared desktop.ini being written to with high-impact permissions in Windows Security logs.

FreeUnreviewedSigmamediumv1

windows-security-event-5145-remote-writes-to-desktop-ini-via-unc-share-35bc7e28

title: "Windows Security Event 5145: Remote writes to desktop.ini via UNC share"
id: c97763f3-985a-4ef7-a948-2612182eec31
status: test
description: This rule identifies Windows processes that access a network-shared desktop.ini file with write-related permissions, including WriteData, DELETE, WriteDAC, AppendData, and AddSubdirectory. Attackers can abuse desktop.ini to influence how folder contents are presented in File Explorer, enabling deception such as renaming or disguising files without modifying their on-disk data. The detection relies on Windows Security auditing (Event ID 5145) capturing remote file access to desktop.ini and the specified access rights.
references:
  - https://isc.sans.edu/forums/diary/Desktopini+as+a+postexploitation+tool/25912/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_net_share_obj_susp_desktop_ini.yml
author: Tim Shelton (HAWK.IO), Huntrule Team
date: 2021-12-06
modified: 2022-01-16
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.009
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5145
    ObjectType: File
    RelativeTargetName|endswith: \desktop.ini
    AccessList|contains:
      - WriteData
      - DELETE
      - WriteDAC
      - AppendData
      - AddSubdirectory
  condition: selection
falsepositives:
  - Read only access list authority
level: medium
license: DRL-1.1
related:
  - id: 35bc7e28-ee6b-492f-ab04-da58fcf6402e
    type: derived

What it detects

This rule identifies Windows processes that access a network-shared desktop.ini file with write-related permissions, including WriteData, DELETE, WriteDAC, AppendData, and AddSubdirectory. Attackers can abuse desktop.ini to influence how folder contents are presented in File Explorer, enabling deception such as renaming or disguising files without modifying their on-disk data. The detection relies on Windows Security auditing (Event ID 5145) capturing remote file access to desktop.ini and the specified access rights.

Known false positives

Read only access list authority

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.