Replace Desktop Wallpaper by Powershell
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users. This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper
Severity
Attention
Rule Requirement
Criteria
Action1: actionname = "PowerShell Script Block Logged" AND (SCRIPTEXECUTED contains "Get-ItemProperty" AND SCRIPTEXECUTED contains "Registry::" AND SCRIPTEXECUTED contains "HKEY_CURRENT_USER\Control Panel\Desktop" AND SCRIPTEXECUTED contains "WallPaper") OR SCRIPTEXECUTED contains "SystemParametersInfo(20,0,*,3)" select Action1.HOSTNAME,Action1.MESSAGE,Action1.SCRIPTEXECUTED
Detection
Execution Mode
realtime
Log Sources
Windows
Author
frack113
