Suspicious Desktopimgdownldr Command

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects a suspicious Microsoft desktopimgdownldr execution with parameters used to download files from the Internet

Known false positives

False positives depend on scripts and administrative tools used in the monitored environment

MITRE ATT&CK coverage

Tactic	Techniques
Command & Control	`T1105` Ingress Tool Transfer

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Suspicious Desktopimgdownldr Command
id: bb58aa4a-b80b-415a-a2c0-2f65a4c81009
status: test
description: Detects a suspicious Microsoft desktopimgdownldr execution with parameters used to download files from the Internet
references:
    - https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/
    - https://twitter.com/SBousseaden/status/1278977301745741825
author: Florian Roth (Nextron Systems)
date: 2020-07-03
modified: 2021-11-27
tags:
    - attack.command-and-control
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection1:
        CommandLine|contains: ' /lockscreenurl:'
    selection1_filter:
        CommandLine|contains:
            - '.jpg'
            - '.jpeg'
            - '.png'
    selection_reg:
        CommandLine|contains|all:
            - 'reg delete'
            - '\PersonalizationCSP'
    condition: ( selection1 and not selection1_filter ) or selection_reg
falsepositives:
    - False positives depend on scripts and administrative tools used in the monitored environment
level: high

Stages and Predicates

Stage 0: `condition`

( selection1 and not selection1_filter ) or selection_reg

Stage 1: `selection1`

selection1:
    CommandLine|contains: ' /lockscreenurl:'

Stage 2: `not selection1_filter`

selection1_filter:
    CommandLine|contains:
        - '.jpg'
        - '.jpeg'
        - '.png'

Stage 3: `selection_reg`

selection_reg:
    CommandLine|contains|all:
        - 'reg delete'
        - '\PersonalizationCSP'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`CommandLine`	match	`.jpeg`	`excludes:CommandLine` `field:"CommandLine" value:".jpeg"`
`CommandLine`	match	`.jpg`	`excludes:CommandLine` `field:"CommandLine" value:".jpg"`
`CommandLine`	match	`.png`	`excludes:CommandLine` `field:"CommandLine" value:".png"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`/lockscreenurl:` `\PersonalizationCSP` `reg delete`	`field:"CommandLine" kind:match`