Potentially Suspicious Desktop Background Change Via Registry (85b88e05-dadc-430b-8a9e-53ff1cd30aae)

Detects registry value settings that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Potentially Suspicious Desktop Background Change Via Registry (85b88e05-dadc-430b-8a9e-53ff1cd30aae)	Sigma-Rules	Modify Registry - T1112 (57340c81-c025-4189-8fa0-fc7ede51bae4)	Attack Pattern	1
Potentially Suspicious Desktop Background Change Via Registry (85b88e05-dadc-430b-8a9e-53ff1cd30aae)	Sigma-Rules	Internal Defacement - T1491.001 (8c41090b-aa47-4331-986b-8c9a51a91103)	Attack Pattern	1
Defacement - T1491 (5909f20f-3c39-4795-be06-ef1ea40d350b)	Attack Pattern	Internal Defacement - T1491.001 (8c41090b-aa47-4331-986b-8c9a51a91103)	Attack Pattern	2