attack.t1547.009

Desktop.INI Created by Uncommon Process

Dec 9, 2025 · attack.privilege-escalation attack.persistence attack.t1547.009 ·

Detects unusual processes accessing desktop.ini, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.

New Custom Shim Database Created

Nov 26, 2025 · attack.privilege-escalation attack.persistence attack.t1547.009 ·

Share on:

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time.

Creation Exe for Service with Unquoted Path

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.009 ·

Share on:

Adversaries may execute their own malicious payloads by hijacking vulnerable file path references. Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.

Windows Network Access Suspicious desktop.ini Action

Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.009 ·

Share on:

Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.