huntrule

Windows: Remote Network Share Writes to desktop.ini

Flags remote network-shared desktop.ini being written to with high-impact permissions in Windows Security logs.

FreeReviewedSigma · Medium · v2
Product
windows
Service
security
Author
Tim Shelton (HAWK.IO) (SigmaHQ), DRL 1.1
Published
2021-12-06
Updated
2026-07-31
AnalysisDetection
title: "Windows: Remote Network Share Writes to desktop.ini"
id: c97763f3-985a-4ef7-a948-2612182eec31
status: test
description: This rule flags Security Event 5145 file access events where a process writes or modifies desktop.ini over a network share. Altering desktop.ini can change how Windows Explorer displays folder contents, which attackers may use to mislead users without changing underlying files. It relies on Windows Security audit telemetry for remote file operations, matching events for desktop.ini with access rights indicating write and modification behavior.
references:
  - https://isc.sans.edu/forums/diary/Desktopini+as+a+postexploitation+tool/25912/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_net_share_obj_susp_desktop_ini.yml
author: Tim Shelton (HAWK.IO), Huntrule Team
date: 2021-12-06
modified: 2022-01-16
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.009
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5145
    ObjectType: File
    RelativeTargetName|endswith: \desktop.ini
    AccessList|contains:
      - WriteData
      - DELETE
      - WriteDAC
      - AppendData
      - AddSubdirectory
  condition: selection
falsepositives:
  - Read only access list authority
level: medium
license: DRL-1.1
related:
  - id: 35bc7e28-ee6b-492f-ab04-da58fcf6402e
    type: derived