Desktop.INI Created by Uncommon Process

Status: test
Severity: medium
Log source: category file_event, product windows
Author: Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO)
Source: github.com/SigmaHQ/sigma

Detects unusual processes accessing desktop.ini, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.

Known false positives

Operations performed through Windows SCCM or equivalent
Read only access list authority

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1547.009` Boot or Logon Autostart Execution: Shortcut Modification
Privilege Escalation	`T1547.009` Boot or Logon Autostart Execution: Shortcut Modification

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule body

title: Desktop.INI Created by Uncommon Process
id: 81315b50-6b60-4d8f-9928-3466e1022515
status: test
description: Detects unusual processes accessing desktop.ini, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.
references:
    - https://isc.sans.edu/forums/diary/Desktopini+as+a+postexploitation+tool/25912/
author: Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO)
date: 2020-03-19
modified: 2025-12-09
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1547.009
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|endswith: '\desktop.ini'
    filter_main_generic:
        Image|startswith:
            - 'C:\Windows\'
            - 'C:\Program Files\'
            - 'C:\Program Files (x86)\'
    filter_main_upgrade:
        TargetFilename|startswith: 'C:\$WINDOWS.~BT\NewOS\'
    filter_optional_jetbrains:
        Image|startswith: 'C:\Users\'
        Image|endswith: '\AppData\Local\JetBrains\Toolbox\bin\7z.exe'
        TargetFilename|contains: '\JetBrains\apps\'
    filter_optional_onedrive:
        Image|startswith: 'C:\Users\'
        Image|contains: '\AppData\Local\Microsoft\OneDrive\'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Operations performed through Windows SCCM or equivalent
    - Read only access list authority
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_* and not 1 of filter_optional_*

Stage 1: `selection`

selection:
    TargetFilename|endswith: '\desktop.ini'

Stage 2: `not filter_main_*`

filter_main_generic:
    Image|startswith:
        - 'C:\Windows\'
        - 'C:\Program Files\'
        - 'C:\Program Files (x86)\'
filter_main_upgrade:
    TargetFilename|startswith: 'C:\$WINDOWS.~BT\NewOS\'

Stage 3: `not filter_optional_*`

filter_optional_jetbrains:
    Image|startswith: 'C:\Users\'
    Image|endswith: '\AppData\Local\JetBrains\Toolbox\bin\7z.exe'
    TargetFilename|contains: '\JetBrains\apps\'
filter_optional_onedrive:
    Image|startswith: 'C:\Users\'
    Image|contains: '\AppData\Local\Microsoft\OneDrive\'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	starts_with	`C:\Program Files (x86)\`	`excludes:Image` `field:"Image" value:"C:\Program Files (x86)\"`
`Image`	starts_with	`C:\Program Files\`	`excludes:Image` `field:"Image" value:"C:\Program Files\"`
`Image`	starts_with	`C:\Windows\`	`excludes:Image` `field:"Image" value:"C:\Windows\"`
`TargetFilename`	starts_with	`C:\$WINDOWS.~BT\NewOS\`	`excludes:TargetFilename` `field:"TargetFilename" value:"C:\$WINDOWS.~BT\NewOS\"`
`Image`	ends_with	`\AppData\Local\JetBrains\Toolbox\bin\7z.exe`	`excludes:Image` `field:"Image" value:"\AppData\Local\JetBrains\Toolbox\bin\7z.exe"`
`Image`	starts_with	`C:\Users\`	`excludes:Image` `field:"Image" value:"C:\Users\"`
`TargetFilename`	match	`\JetBrains\apps\`	`excludes:TargetFilename` `field:"TargetFilename" value:"\JetBrains\apps\"`
`Image`	match	`\AppData\Local\Microsoft\OneDrive\`	`excludes:Image` `field:"Image" value:"\AppData\Local\Microsoft\OneDrive\"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetFilename`	ends_with	`\desktop.ini`	`field:"TargetFilename" kind:ends_with value:"\desktop.ini"`