Makop Ransomware - Desktop Wallpaper Modification via Unknown Process
Detects wallpaper registry modifications using .bmp files, indicative of a ransom note being set by an unusual process. The rule specifically looks for changes to the 'Wallpaper' value or any key containing '\Control Panel\Desktop' in the registry, where the new wallpaper file ends with '.bmp'. It excludes modifications made by common system processes like 'explorer.exe', 'svchost.exe', and 'systemsettings.exe' to reduce false positives.
Microsoft Sentinel (KQL)
