BIOC
Low
✕
Suspicious lock screen image file written to disk
Desktopimgdownldr.exe is a built-in Windows tool used to set a lock screen or desktop background image as part of Personalization CSP. Adversaries may use it maliciously to download malware.
- Module:
- Platform Analytics
- Agent event type:
- File
- Category:
- Execution
- Status:
- Enabled
ATT&CK tactics: Command and Control (TA0011)
ATT&CK techniques: Ingress Tool Transfer (T1105)
Indicator:
File action type = create , write , rename AND file path = *personalization\lockscreenimage* Process os parent name = desktopimgdownldr.exe , svchost.exe AND cgo name != omadmprc.exe AND CcmExec.exe AND GoogleUpdate.exe AND ServiceShell.exe AND os parent cmd != *svchost.exe*-k*gpsvc*
Preventable: yes