File written to a wallpaper, logon background or intranet web root

1title: File written to a wallpaper, logon background or intranet web root2id: 81c5145a-2f58-4014-9fe0-88fbfd79b8033status: experimental4description: |5  Internal defacement on Windows lands as a file write: a new wallpaper, a6  replaced logon-screen background, or altered content under an intranet web7  root. This rule matches Sysmon File Creation — which also fires when an8  existing file is overwritten — on `TargetFilename` under the locations MITRE's9  FilePathPattern knob names, plus the two logon-branding directories that carry10  the same behaviour. Path is the only field the analytic actually constrains;11  MITRE's other knobs, TimeWindow (off-hours) and UserContext (which account is12  writing), are time and baseline conditions that Sigma cannot hold, so they are13  left to tuning rather than approximated with fields that would not mean what14  they appear to.15  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0082, not hand-written and not tested by its author. Any lab result is on this rule's own page.16references:17  - https://attack.mitre.org/techniques/T1491/00118  - https://attack.mitre.org/detectionstrategies/DET008219author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)20date: 2026-08-1621tags:22  - attack.impact23  - attack.t1491.00124logsource:25  category: file_event26  product: windows27detection:28  selection:29    TargetFilename|contains:30      - '\Windows\Web\Wallpaper\'31      - '\Windows\Web\Screen\'32      - '\Windows\Web\4K\'33      - '\AppData\Roaming\Microsoft\Windows\Themes\'34      - '\System32\oobe\info\backgrounds\'35      - '\inetpub\wwwroot\'36  condition: selection37falsepositives:38  - "A user changing their own desktop background, which rewrites TranscodedWallpaper and the slideshow state under %APPDATA%\\Microsoft\\Windows\\Themes on every change. This is the single loudest source here and is why MITRE's UserContext knob matters — the write is expected from explorer.exe under the interactive user, not from a script interpreter or a service account."39  - "Corporate branding and theme deployment via Group Policy, MDM or an imaging task sequence, which writes wallpaper and logon-background files across many hosts at once, usually inside a maintenance window."40  - "Ordinary publishing to an intranet site — a web deploy, CI release or CMS save writing under \\inetpub\\wwwroot — which is indistinguishable from defacement on path alone and needs the publishing account and change window to separate it."41  - "Windows feature and cumulative updates that replace the stock images under %SystemRoot%\\Web after servicing."42level: medium