Detect Suspicious Actions To Change Desktop Background
Query
DeviceProcessEvents
| where ProcessCommandLine has_any (
"reg delete \"HKCU\\Control Panel\\Desktop\"",
"reg add \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\ActiveDesktop\"",
"NoChangingWallPaper"
)
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, AccountName, ReportIdAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1491.001 | Defacement: Internal Defacement |
Author: Sergio Albea (28/05/2025)
Detect suspicious actions to change Desktop Background
One of the key behaviors often observed during ransomware attacks includes altering the desktop background. These actions are designed to ensure that all users on the infected machine are made aware of the compromise. Fortunately, if your environment monitors for registry changes , you may be able to detect such activities promptly. This can enable quick response actions—such as alerting, isolating the device (using Detection Rules Actions), or initiating automated investigation.
Changing a device background manually, is kind of expected user behaviour if you are allowing it. However, modify the associated register keys via command line, can be a good indicator about a Ransomware activity. Both of following cases, are commonly abused by ransomware (e.g., Rhysida,BlackCat) to control or lock desktop wallpaper settings.
Explanation
This query is designed to detect suspicious activities related to changing the desktop background on a device, which is a common tactic used in ransomware attacks to alert users of a compromise. Specifically, it looks for command-line actions that modify certain registry keys associated with desktop wallpaper settings. These modifications are often indicative of ransomware activity, as they can be used to control or lock the desktop wallpaper.
The query monitors for processes that execute commands to delete or add registry keys related to the desktop background settings. If such actions are detected, it captures and displays relevant details such as the timestamp, device name, the name of the process initiating the change, the command line used, the account name, and a report ID. This information can help in quickly identifying and responding to potential ransomware attacks by alerting security teams, isolating the affected device, or initiating automated investigations.
