
title: Suspicious Desktopimgdownldr Command
author: Florian Roth
date: 2020/07/03
description: Detects a suspicious Microsoft desktopimgdownldr execution with parameters
  used to download files from the Internet
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    EventID: 1
  SELECTION_3:
    CommandLine: '* /lockscreenurl:*'
  SELECTION_4:
    CommandLine:
    - '*.jpg*'
    - '*.jpeg*'
    - '*.png*'
  SELECTION_5:
    CommandLine: '*reg delete*'
  SELECTION_6:
    CommandLine: '*\PersonalizationCSP*'
  condition: (SELECTION_1 and ((SELECTION_2 and SELECTION_3 and  not (SELECTION_4))
    or (SELECTION_5 and SELECTION_6)))
falsepositives:
- False positives depend on scripts and administrative tools used in the monitored
  environment
fields:
- CommandLine
- ParentCommandLine
id: bb58aa4a-b80b-415a-a2c0-2f65a4c81009
level: high
logsource:
  category: process_creation
  product: windows
modified: 2020/08/30
references:
- https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/
- https://twitter.com/SBousseaden/status/1278977301745741825
status: experimental
tags:
- attack.command_and_control
- attack.t1105
ruletype: SIGMA
