How to detect which process changes background desktop

[Ted Ngo 0]

Dear Team, 

I am looking the way create a rule to detect which service changed background desktop of clients, Can you please help me provide a rule.

[dmaasland 2]

Try something like this:

 

<?xml version="1.0" encoding="utf-8"?>
<rule>
    <definition>
        <operations>
            <operation type="WriteFile">
                <operator type="or">
                    <condition component="FileItem" property="Path" condition="starts" value="%APPDATA%\microsoft\windows\themes\cachedfiles\" />
                    <condition component="FileItem" property="FullPath" condition="is" value="%APPDATA%\microsoft\windows\themes\transcodedwallpaper" />
                </operator>
            </operation>
            <operation type="RegSetValue">
                <condition component="RegistryItem" property="Key" condition="starts" value="HKCU\software\microsoft\windows\currentversion\explorer\wallpapers\backgroundhistorypath" />
            </operation>
            <operation type="RegDeleteValue">
                <condition component="RegistryItem" property="Key" condition="starts" value="HKCU\software\microsoft\windows\currentversion\explorer\wallpapers\backgroundhistorypath" />
            </operation>
        </operations>
    </definition>
    <description>
        <name>Wallpaper was altered</name>
        <explanation>
            The wallpaper was altered
        </explanation>
        <category>
            Default
        </category>
    </description>
</rule>