T1546.002PersistencePrivilege Escalation
Screensaver
Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a.scr file extension. The Windows screensaver application scrnsave.scr is located in C:\Windows\System32\, and C:\Windows\sysWOW64\ on 64-bit Windows systems, along…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
4 Sigma rules tagged T1546.002ScreensaverT1546.0024 general rules
- Path To Screensaver Binary Modifiedmediumtest
- Suspicious ScreenSave Change by Reg.exemediumtest
- Suspicious Screensaver Binary File Creationmediumtest
- Writing Local Admin Sharemediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Screensaver
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.