Windows Network Access Suspicious desktop.ini Action

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•32

Detects unusual processes accessing 'desktop.ini' remotely over a network share with write permissions. This activity can be leveraged to alter how Windows Explorer displays a folder's content (e.g., renaming files) without actually changing the files on disk, which can be used for persistence or privilege escalation.