File written to a wallpaper, logon background or intranet web root

Siemphony@siemphonymediumT1491.001unverified

Internal defacement on Windows lands as a file write: a new wallpaper, a replaced logon-screen background, or altered content under an intranet web root. This rule matches Sysmon File Creation — which also fires when an existing file is overwritten — on `TargetFilename` under the locations MITRE's FilePathPattern knob names, plus the two logon-branding directories that carry the same behaviour. Path is the only field the analytic actually constrains; MITRE's other knobs, TimeWindow (off-hours) and UserContext (which account is writing), are time and baseline conditions that Sigma cannot hold, so they are left to tuning rather than approximated with fields that would not mean what they appear to. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0082, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceFileEvents| where (FolderPath contains "\\Windows\\Web\\Wallpaper\\" or FolderPath contains "\\Windows\\Web\\Screen\\" or FolderPath contains "\\Windows\\Web\\4K\\" or FolderPath contains "\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\" or FolderPath contains "\\System32\\oobe\\info\\backgrounds\\" or FolderPath contains "\\inetpub\\wwwroot\\")

Splunk · SPL

Run this as a search.

index=* (TargetFilename="*\\Windows\\Web\\Wallpaper\\*" OR TargetFilename="*\\Windows\\Web\\Screen\\*" OR TargetFilename="*\\Windows\\Web\\4K\\*" OR TargetFilename="*\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\*" OR TargetFilename="*\\System32\\oobe\\info\\backgrounds\\*" OR TargetFilename="*\\inetpub\\wwwroot\\*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(file.path) LIKE "*\\\\windows\\\\web\\\\wallpaper\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\windows\\\\web\\\\screen\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\windows\\\\web\\\\4k\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\appdata\\\\roaming\\\\microsoft\\\\windows\\\\themes\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\system32\\\\oobe\\\\info\\\\backgrounds\\\\*" OR TO_LOWER(file.path) LIKE "*\\\\inetpub\\\\wwwroot\\\\*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,file_event,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetFilename" type="pcre2">(?i)(\\Windows\\Web\\Wallpaper\\|\\Windows\\Web\\Screen\\|\\Windows\\Web\\4K\\|\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\|\\System32\\oobe\\info\\backgrounds\\|\\inetpub\\wwwroot\\)</field>    <description>File written to a wallpaper, logon background or intranet web root</description>    <mitre>      <id>T1491.001</id>    </mitre>  </rule></group>

At a glance

Logsource: file_event / windows
Level: medium
Category: impact_destruction
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 81c5145a-2f58-4014-9fe0-88fbfd79b803

ATT&CKT1491.001

T1491.001Internal Defacement

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonimpact destruction

impact destructionAI draft — unreviewed

01 · What this rule detects

A file being written under a wallpaper directory, a logon-branding directory, or the default IIS web root. Internal defacement is one of the few techniques whose evidence really is a file write, so unlike most rules here this one is not settling for a precursor — MITRE's AN0229 describes exactly this. What it settles for is path as the only discriminator. AN0229's other two knobs, TimeWindow (off-hours) and UserContext (which account wrote it), are a clock and a baseline; Sigma holds neither, so the rule states the one condition it can rather than approximating the others with fields that would not mean what they appear to.

02 · Telemetry you need

Sysmon EventID 11, File Creation. This matters more than it looks: the
Sysmon file-creation logging not excluded for %APPDATA%. Most tuned configs

03 · How the logic works

One selection, one field, six substrings:

That list is MITRE's `FilePathPattern` knob populated by the author. MITRE supplies the knob and two examples (%SystemRoot%\Web, %APPDATA%\wallpaper.jpg); the six literals here are authored, not sourced. contains with a leading and trailing backslash anchors each match to a directory component: \Themes\ cannot be satisfied by a file named Themes.log, and everything beneath the directory is in scope regardless of filename. Sigma does not expand environment variables, so %APPDATA% is written as its literal tail \AppData\Roaming\… — the part of the path identical on every host. Three of the six deserve scepticism, and the reviewer supplied it. \System32\oobe\info\backgrounds\ is the Windows 7 OEMBackground path; the mechanism was removed in Windows 8 and the branch is dead on any supported OS. \Windows\Web\4K\ and \Windows\Web\Screen\ are TrustedInstaller-ACLed, so only servicing or an attacker who already has SYSTEM writes there. And the intranet leg rests entirely on \inetpub\wwwroot\, the IIS Default Web Site's physical path — a production site rooted at D:\Sites\intranet is invisible. Six patterns, roughly two live ones. Two blind spots. Sysmon 11 fires on create and overwrite but not on in-place modification: a web shell that opens index.html, seeks and patches bytes produces no event at all. And the wallpaper can be changed with no file written under any monitored path — point HKCU\Control Panel\Desktop\Wallpaper at C:\Users\Public\deface.jpg and the rule never sees it.

04 · Common false positives

The Themes directory is a firehose. The rule's false positives frame those
Branding and theme deployment by GPO, MDM or an imaging task sequence.
Ordinary intranet publishing — a CI release or CMS save under \inetpub\wwwroot
Feature and cumulative updates replacing stock images under %SystemRoot%\Web.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0082 and never executed against a log line. No Sentinel translation exists: the translator refuses file_event/windows rather than emit a query against a table it has not modelled, which is the correct behaviour and worth noticing.
tier_2: confirm which event feeds your file_event pipeline, measure the Themes volume for a week, and replace the default web root with your real ones.
tier_3: adds MITRE's TimeWindow and a writing-process baseline, neither of which lives in this YAML.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Populate the web-root list per host from applicationHost.config (IIS) or
Split the Themes pattern into its own low-severity rule, or drop it and keep
Annotate or remove the oobe path so nobody reads the list as six live
MITRE's UserContext knob is the real discriminator: explorer.exe under the
To close the in-place gap, add the Security 4663 leg (ObjectName plus

Declared by the author

A user changing their own desktop background, which rewrites TranscodedWallpaper and the slideshow state under %APPDATA%\Microsoft\Windows\Themes on every change. This is the single loudest source here and is why MITRE's UserContext knob matters — the write is expected from explorer.exe under the interactive user, not from a script interpreter or a service account.
Corporate branding and theme deployment via Group Policy, MDM or an imaging task sequence, which writes wallpaper and logon-background files across many hosts at once, usually inside a maintenance window.
Ordinary publishing to an intranet site — a web deploy, CI release or CMS save writing under \inetpub\wwwroot — which is indistinguishable from defacement on path alone and needs the publishing account and change window to separate it.
Windows feature and cumulative updates that replace the stock images under %SystemRoot%\Web after servicing.

Noise check0 of 3 fired

Fires on none of the 3 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 3 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1491.001, evaluated against their file_event events.

Share this rule

/u/siemphony/81c5145a-2f58-4014-9fe0-88fbfd79b803

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

File written to a wallpaper, logon background or intranet web root

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it