Potentially Suspicious Desktop Background Change Via Registry

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•21

Detects registry value settings that would replace the user's desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image.