Detect Suspicious Actions To Change Desktop Background
Query
DeviceProcessEvents
| where ProcessCommandLine has_any (
"reg delete \"HKCU\\Control Panel\\Desktop\"",
"reg add \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\ActiveDesktop\"",
"NoChangingWallPaper"
)
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, AccountName, ReportIdAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1491.001 | Defacement: Internal Defacement |
Author: Sergio Albea (05/06/2026)
Detect suspicious actions to change Desktop Background
One of the key behaviors often observed during ransomware attacks includes altering the desktop background. These actions are designed to ensure that all users on the infected machine are made aware of the compromise. Fortunately, if your environment monitors for registry changes , you may be able to detect such activities promptly. This can enable quick response actions—such as alerting, isolating the device (using Detection Rules Actions), or initiating automated investigation.
Changing a device background manually, is kind of expected user behaviour if you are allowing it. However, modify the associated register keys via command line, can be a good indicator about a Ransomware activity. Both of following cases, are commonly abused by ransomware (e.g., Rhysida,BlackCat) to control or lock desktop wallpaper settings.
Explanation
This query is designed to detect suspicious activities related to changes in the desktop background, which can be an indicator of ransomware attacks. Specifically, it looks for command-line actions that modify certain Windows registry keys associated with desktop wallpaper settings. These modifications are often used by ransomware, such as Rhysida and BlackCat, to control or lock the desktop background, making users aware of the compromise.
The query searches for specific commands in the DeviceProcessEvents data, focusing on:
- Deleting the registry key for desktop settings:
"reg delete \"HKCU\\Control Panel\\Desktop\"" - Adding a policy to prevent wallpaper changes:
"reg add \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\ActiveDesktop\"" - Setting a policy to prevent wallpaper changes:
"NoChangingWallPaper"
If any of these actions are detected, the query will output relevant details such as the timestamp, device name, initiating process file name, command line used, account name, and report ID. This information can be used to quickly respond to potential ransomware activities by alerting security teams, isolating affected devices, or starting automated investigations.
