kevmap

Techniques › T1546 › T1546.002

T1546.002 Screensaver

privilege escalation · persistence — Windows · attack.mitre.org · JSON

1
MITRE detection strategy
1
analytics
4
Sigma rules tagged attack.t1546.002
0
KEV CVEs mapped here
<p>Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension. The Windows screensaver application scrnsave.scr is located in <code>C:\Windows\System32\</code>, and <code>C:\Windows\sysWOW64\</code> on 64-bit Windows systems, along with screensavers included with base Windows installations.</p><p>The following screensaver settings are stored in the Registry (<code>HKCU\Control Panel\Desktop\</code>) and could be manipulated to achieve persistence:</p>
    <li><code>SCRNSAVE.exe</code> - set to malicious PE path</li><li><code>ScreenSaveActive</code> - set to '1' to enable the screensaver</li><li><code>ScreenSaverIsSecure</code> - set to '0' to not require a password to unlock</li><li><code>ScreenSaveTimeout</code> - sets user inactivity timeout before screensaver is executed</li>
<p>Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1546.002

Suspicious ScreenSave Change by Reg.exe mediumtest
Author: frack113 · 2021-08-19 (modified 2022-06-02) · logsource: product=windows category=process_creation · 0fc35fc3-efe6-4898-8a37-0b233339524f
Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension
Techniques: T1546.002
Writing Local Admin Share mediumtest
Author: frack113 · 2022-01-01 (modified 2022-08-13) · logsource: product=windows category=file_event · 4aafb0fa-bff5-4b9d-b99e-8093e659c65f
Aversaries may use to interact with a remote network share using Server Message Block (SMB). This technique is used by post-exploitation frameworks.
Techniques: T1546.002
Path To Screensaver Binary Modified mediumtest
Author: Bartlomiej Czyz @bczyz1, oscd.community · 2020-10-11 (modified 2021-11-27) · logsource: product=windows category=registry_event · 67a6c006-3fbe-46a7-9074-2ba3b82c3000
Detects value modification of registry key containing path to binary used as screensaver.
Techniques: T1546.002
Suspicious Screensaver Binary File Creation mediumtest
Author: frack113 · 2021-12-29 (modified 2022-11-08) · logsource: product=windows category=file_event · 97aa2e88-555c-450d-85a6-229bcd87efb8
Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension
Techniques: T1546.002

Rules tagged at the parent level (attack.t1546) 10

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

COM Hijack via Sdclt hightest
Author: Omkar Gudhate · 2020-09-27 (modified 2023-09-28) · logsource: product=windows category=registry_set · 07743f65-7ec9-404a-a519-913db7118a8d
Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'
Techniques: T1546T1548
Control Panel Items hightest
Author: Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_) · 2020-06-22 (modified 2023-10-11) · logsource: product=windows category=process_creation · 0ba863e6-def5-4e50-9cea-4dd8c7dc46a4
Detects the malicious use of a control panel item
Techniques: T1218.002T1546
Suspicious Get-Variable.exe Creation hightest
Author: frack113 · 2022-04-23 · logsource: product=windows category=file_event · 0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b
Get-Variable is a valid PowerShell cmdlet WindowsApps is by default in the path where PowerShell is executed. So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.
Techniques: T1546T1027
Suspicious Outlook Macro Created hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2023-02-08 · logsource: product=windows category=file_event · 117d3d3a-755c-4a61-b23e-9171146d094c
Detects the creation of a macro file for Outlook.
Techniques: T1137T1008T1546
Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting hightest
Author: Nasreddine Bencherchali (Nextron Systems) · 2021-04-05 (modified 2023-08-17) · logsource: product=windows category=registry_set · 396ae3eb-4174-4b9b-880e-dc0364d78a19
Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module
Techniques: T1137T1008T1546
MSSQL Extended Stored Procedure Backdoor Maggie hightest
Author: Denis Szadkowski, DIRT / DCSO CyTec · 2022-10-09 · logsource: product=windows service=application · 711ab2fe-c9ba-4746-8840-5228a58c3cb8
This rule detects the execution of the extended storage procedure backdoor named Maggie in the context of Microsoft SQL server
Techniques: T1546
SOURGUM Actor Behaviours hightest
Author: MSTIC, FPT.EagleEye · 2021-06-15 (modified 2022-10-09) · logsource: product=windows category=process_creation · 7ba08e95-1e0b-40cd-9db5-b980555e42fd
Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM
Techniques: T1546T1546.015
New Outlook Macro Created mediumtest
Author: @ScoubiMtl · 2021-04-05 (modified 2023-02-08) · logsource: product=windows category=file_event · 8c31f563-f9a7-450c-bfa8-35f8f32f1f61
Detects the creation of a macro file for Outlook.
Techniques: T1137T1008T1546
HAFNIUM Exchange Exploitation Activity criticaltest
Author: Florian Roth (Nextron Systems) · 2021-03-09 (modified 2023-03-09) · logsource: product=windows category=process_creation · bbb2dedd-a0e3-46ab-ba6c-6c82ae7a9aa7
Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers
Techniques: T1546T1053
Outlook Macro Execution Without Warning Setting Enabled hightest
Author: @ScoubiMtl · 2021-04-05 (modified 2023-08-17) · logsource: product=windows category=registry_set · e3b50fa5-3c3f-444e-937b-0a99d33731cd
Detects the modification of Outlook security setting to allow unprompted execution of macros.
Techniques: T1137T1008T1546