Suspicious Desktopimgdownldr Command
Last updated on:
In this page
Rule name | Rule type | Log sources | MITRE ATT&CK tags | Severity |
Suspicious Desktopimgdownldr Command | Standard | Windows | Command and Control: Ingress Tool Transfer (T1105) | Trouble |
About the rule
Rule Type
Standard
Rule Description
Desktopimgdownldr.exe is a legitimate Windows system process responsible for downloading and applying new lock screen and desktop images (typically for Windows Spotlight functionality). Attackers may abuse this process to execute arbitrary commands, download malicious payloads, or establish unauthorized network connections using crafted command-line arguments. This rule is designed to detect anomalous or suspicious invocations of desktopimgdownldr.exe—such as usage with non-standard command-line switches, connections to unexpected remote servers, or attempts to write files outside approved directories—which may indicate command execution, credential theft, or covert data transfers by adversaries.
Severity
Trouble
Rule journey
Attack chain scenario
Initial access → Phishing → Execution → Abuse of desktopimgdownldr.exe → Command and Control → Impact
Impact
- Defense evasion
- Unauthorized command execution
- Malware download or deployment
- Data exfiltration
- System persistence
Rule Requirement
Prerequisites
Use the Group Policy Management Console to audit process creation and process termination.
Install Sysmon from Microsoft Sysinternals and download the Sysmon configuration file that includes process creation monitoring. Add network connection events to the configuration file to monitor all network activity.
Create a new registry key "Microsoft-Windows-Sysmon/Operational" in the directory "Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\" if not already created.
Criteria
Action1: actionname = "Process started" AND (COMMANDLINE contains " /lockscreenurl:" AND COMMANDLINE notcontains ".jpg,.jpeg,.png") OR (COMMANDLINE contains "reg delete" AND COMMANDLINE contains "\PersonalizationCSP") select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
MITRE ATT&CK
Command and Control: Ingress Tool Transfer (T1105)
Security Standards
Enabling this rule will help you meet the security standard's requirement listed below:
DE.CM-01: Networks and network services are monitored to find potentially adverse events.
When this rule is triggered, you’re notified of a suspicious invocation of Desktopimgdownldr.exe, such as unexpected command-line arguments, unauthorized file operations, or connections to untrusted servers. This enables you to review process usage, analyze command-line behavior, and promptly identify anomalous activity involving Desktopimgdownldr.exe, supporting proactive monitoring and rapid response to potential threats.
Author
Florian Roth (Nextron Systems)
Future actions
Known False Positives
This rule may trigger during legitimate Windows Spotlight updates or corporate image-management solutions that issue non-standard image update commands. Review command-line parameters and network destinations for legitimacy.
Next Steps
When this rule is triggered, the following measures can be implemented:
- Identification: Identify if the flagged event is a new incident or part of an existing incident.
- Analysis: Analyze the impact and extent of the incident to comprehend the severity of the attack using the Incident Workbench.
- Response: Respond promptly by initiating an automated workflow to interrupt the network connections and cease the malicious process.
- Reconfiguration: Revise allowlists for legitimate internal usage, update detection analytics, and continue monitoring for similar behaviors.
Mitigation
Mitigation ID | Mitigation Name | Mitigation description |
M1031 | Network Intrusion Prevention | Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware or unusual data transfer over known protocols like FTP can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools.(Citation: University of Birmingham C2) |
