Windows Network Access Suspicious desktop.ini Action

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•0•1

Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.