Cross-source coverage
T1546.002 / ATT&CK
Event Triggered Execution: Screensaver
From MITRE ATT&CK 19.2
Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a.scr file extension. The Windows screensaver application scrnsave.scr is located in C:\Windows\System32\, and C:\Windows\sysWOW64\ on 64-bit Windows systems, along with screensavers included with base Windows installations.
The following screensaver settings are stored in the Registry (HKCU\Control Panel\Desktop\) and could be manipulated to achieve persistence:
SCRNSAVE.exe- set to malicious PE pathScreenSaveActive- set to '1' to enable the screensaverScreenSaverIsSecure- set to '0' to not require a password to unlockScreenSaveTimeout- sets user inactivity timeout before screensaver is executed
Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity.
- Tactics
- Privilege Escalation · Persistence
- Platforms
- Windows
- Telemetry
-
WinEventLog:SecurityWinEventLog:Sysmon
How MITRE says to detect it DET0154
Detect Screensaver-Based Persistence via Registry and Execution Chains
Windows Analytic 0441
Unusual screensaver (.scr) executions correlated with recent registry modifications to HKCU\Control Panel\Desktop values such as SCRNSAVE.exe, ScreenSaveTimeout, and ScreenSaveActive. Detection focuses on PE image paths not consistent with known legitimate screensavers and triggered after user inactivity timeout.
WinEventLog:SecurityEventCode=4688WinEventLog:SysmonEventCode=13, 14
SigmaHQ/sigma
4 rules| Detection | Severity | Format |
|---|---|---|
| Path To Screensaver Binary Modified | Medium | Sigma |
| Suspicious ScreenSave Change by Reg.exe | Medium | Sigma |
| Suspicious Screensaver Binary File Creation | Medium | Sigma |
| Writing Local Admin Share | Medium | Sigma |
elastic/detection-rules
3 rules| Detection | Severity | Format |
|---|---|---|
| Screensaver Plist File Modified by Unexpected Process | Medium | Elastic TOML |
| Uncommon Registry Persistence Change | Medium | Elastic TOML |
| Unexpected Child Process of macOS Screensaver Engine | Medium | Elastic TOML |
elastic/protections-artifacts
1 rule| Detection | Severity | Format |
|---|---|---|
| Unexpected Child Process of macOS Screensaver Engine | Undefined | Elastic TOML |
splunk/security_content
1 rule| Detection | Severity | Format |
|---|---|---|
| Screensaver Event Trigger Execution | Undefined | SPL |