Windows: Suspicious desktopimgdownldr Writes Lock Screen Images to Unusual Paths

Alerts on desktopimgdownldr-style lock screen image target writes to non-system paths with suspicious filename characteristics.

FreeUnreviewedSigmahighv1

windows-suspicious-desktopimgdownldr-writes-lock-screen-images-to-unusual-paths-fc4f4817

title: "Windows: Suspicious desktopimgdownldr Writes Lock Screen Images to Unusual Paths"
id: cad72ede-7de6-4103-82a1-d92b40dcf0b4
status: test
description: This rule flags creation events where an Image file with the name ending in \svchost.exe targets a path under \Personalization\LockScreenImage\. It further narrows matches to instances where the target filename is neither within C:\Windows\ nor contains common image extensions such as .jpg, .jpeg, or .png. Attackers may misuse this type of native file handling to place payloads in user-facing locations and evade straightforward extension-based detections, making it important to correlate process-related image naming with target paths and filenames from file event telemetry.
references:
  - https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/
  - https://twitter.com/SBousseaden/status/1278977301745741825
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_desktopimgdownldr_file.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-07-03
modified: 2022-06-02
tags:
  - attack.command-and-control
  - attack.t1105
logsource:
  product: windows
  category: file_event
detection:
  selection:
    Image|endswith: \svchost.exe
    TargetFilename|contains: \Personalization\LockScreenImage\
  filter1:
    TargetFilename|contains: C:\Windows\
  filter2:
    TargetFilename|contains:
      - .jpg
      - .jpeg
      - .png
  condition: selection and not filter1 and not filter2
falsepositives:
  - False positives depend on scripts and administrative tools used in the monitored environment
level: high
license: DRL-1.1
related:
  - id: fc4f4817-0c53-4683-a4ee-b17a64bc1039
    type: derived

What it detects

This rule flags creation events where an Image file with the name ending in \svchost.exe targets a path under \Personalization\LockScreenImage\. It further narrows matches to instances where the target filename is neither within C:\Windows\ nor contains common image extensions such as .jpg, .jpeg, or .png. Attackers may misuse this type of native file handling to place payloads in user-facing locations and evade straightforward extension-based detections, making it important to correlate process-related image naming with target paths and filenames from file event telemetry.

Known false positives

False positives depend on scripts and administrative tools used in the monitored environment

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.