Event Triggered Execution: Screensaver

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.[1] The Windows screensaver application scrnsave.scr is located in C:\Windows\System32\, and C:\Windows\sysWOW64\ on 64-bit Windows systems, along with screensavers included with base Windows installations.

The following screensaver settings are stored in the Registry (HKCU\Control Panel\Desktop\) and could be manipulated to achieve persistence:

  • SCRNSAVE.exe - set to malicious PE path
  • ScreenSaveActive - set to '1' to enable the screensaver
  • ScreenSaverIsSecure - set to '0' to not require a password to unlock
  • ScreenSaveTimeout - sets user inactivity timeout before screensaver is executed

Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity.[2]

ID: T1546.002
Sub-technique of:  T1546
Platforms: Windows
Permissions Required: User
Contributors: Bartosz Jerzman
Version: 1.2
Created: 24 January 2020
Last Modified: 28 July 2023

Procedure Examples

ID Name Description
S0168 Gazer

Gazer can establish persistence through the system screensaver by configuring it to execute the malware.[2]

Mitigations

ID Mitigation Description
M1042 Disable or Remove Feature or Program

Use Group Policy to disable screensavers if they are unnecessary.[3]

M1038 Execution Prevention

Block .scr files from being executed from non-standard locations.

Detection

ID Data Source Data Component Detects
DS0017 Command Command Execution

Monitor executed commands and arguments of .scr files.

Analytic 1 - Modify the HKCU\Control Panel\Desktop registry key

suspicious_processes = filter processes where (event_id == "1" OR event_id == "4688") AND (ProcessCommandLine LIKE '%reg%' AND ProcessCommandLine LIKE '%add%' AND ProcessCommandLine LIKE '%HKCU\Control Panel\Desktop\%')

DS0022 File File Creation

Monitor newly constructed files that may establish persistence by executing malicious content triggered by user inactivity.

Analytic 1 - Created on disk that are being used as Screensaver files

screensaver_key_modification = filter ProcessGuid, ProcessFilePath, UserName, RegistryKeyPath, RegistryKeyValueData where event_id == "13" AND RegistryKeyPath LIKE '%Software\Policies\Microsoft\Windows\Control Panel\Desktop\SCRNSAVE.EXE%'

new_files = filter ProcessFilePath, UserName, FileName where event_id == "11"

suspicious_files = filter k.ProcessGuid, k.ProcessFilePath, k.UserName, k.RegistryKeypath, k.RegistryKeyValueData FROM screensaver_key_modification kINNER JOIN new_files fON k.RegistryKeyValueData = f.FileName

File Modification

Monitor for changes made to files that may establish persistence by executing malicious content triggered by user inactivity.

Note: Although there are no standard events for file modification, Windows Event ID 4663 (An Attempt Was Made to Access An Object) can be used to alert on attempted accesses of screensaver files (typically ending in a file extension of .scr).

DS0009 Process Process Creation

Monitor newly executed processes that may establish persistence by executing malicious content triggered by user inactivity.

Analytic 1 : New processes whose image files are being used as Screensaver files and make an outbound network connection to unknown IP address

new_processes = filter ProcessGuid, ProcessFilePath, ProcessCommandLine, UserNameFROM ProcessCreationDataWHERE event_id == "1"

new_network_connections = filter ProcessFilePath, DestinationIpFROM NetworkConnectionDataWHERE event_id == "3"

screensaver_key_modification = filter ProcessGuid, ProcessFilePath, UserName, RegistryKeyPath, RegistryKeyValueData FROM KeyModificationDataWHERE event_id == "13" AND RegistryKeyPath LIKE '%Software\Policies\Microsoft\Windows\Control Panel\Desktop\SCRNSAVE.EXE%'

screensaver_processes = filter p.ProcessGuid, p.ProcessFilePath, p.UserNameFROM new_processes pINNER JOIN screensaver_key_modification kON p.ProcessFilePath = k.RegistryKeyValueData

suspicious_processes = filter p.ProcessGuid, p.ProcessFilePath, p.UserName, n.DestinationIpFROM new_network_connections nINNER JOIN screensaver_processes pON p.ProcessFilePath = n.ProcessFilePathWHERE n.DestinationIP NOT IN ('KnownIp01','KnownIp02')

DS0024 Windows Registry Windows Registry Key Modification

Monitor changes to screensaver configuration changes in the Registry that may not correlate with typical user behavior. Tools such as Sysinternals Autoruns can be used to detect changes to the screensaver binary path in the Registry. Default screen saver files are stored in C:\Windows\System32. Use these files as a reference when defining list of not suspicious screen saver files.

Analytic 1 : Registry Edit from Screensaver

scr_reg_events = filter processes where ( event_id == "13" AND key="*\Software\Policies\Microsoft\Windows\Control Panel\Desktop\SCRNSAVE.EXE" AND RegistryKeyValueData NOT IN ('PathToScreenSaverFile1','PathToScreenSaverFile2'))

References