Suspicious desktop.ini File Access

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•29

Detects unusual processes accessing `desktop.ini` files. Adversaries can leverage `desktop.ini` to alter how Windows Explorer displays a folder's content (e.g., renaming files or changing icons) without modifying the actual files on disk. This can be used for persistence, privilege escalation, or to hide malicious files.