Remote File Download Via Desktopimgdownldr Utility

Title: Remote File Download Via Desktopimgdownldr Utility
Status: test
Description:Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil.
References:
  -https://www.elastic.co/guide/en/security/current/remote-file-download-via-desktopimgdownldr-utility.html
Author: Tim Rauch, Elastic (idea)
Date: 2022-09-27
modified:None
Tags:

• -'attack.command-and-control'
• -'attack.t1105'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\desktopimgdownldr.exe'
    ParentImage|endswith: '\desktopimgdownldr.exe'
    CommandLine|contains: '/lockscreenurl:http'
  condition:selection
Falsepositives:
  -Unknown
Level: medium