|T1546.001||Change Default File Association|
|T1546.003||Windows Management Instrumentation Event Subscription|
|T1546.004||Unix Shell Configuration Modification|
|T1546.007||Netsh Helper DLL|
|T1546.012||Image File Execution Options Injection|
|T1546.015||Component Object Model Hijacking|
Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension. The Windows screensaver application scrnsave.scr is located in
C:\Windows\sysWOW64\ on 64-bit Windows systems, along with screensavers included with base Windows installations.
The following screensaver settings are stored in the Registry (
HKCU\Control Panel\Desktop\) and could be manipulated to achieve persistence:
SCRNSAVE.exe- set to malicious PE path
ScreenSaveActive- set to '1' to enable the screensaver
ScreenSaverIsSecure- set to '0' to not require a password to unlock
ScreenSaveTimeout- sets user inactivity timeout before screensaver is executed
Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity.
|M1042||Disable or Remove Feature or Program||
Use Group Policy to disable screensavers if they are unnecessary.
Block .scr files from being executed from non-standard locations.
|ID||Data Source||Data Component||Detects|
Monitor executed commands and arguments of .scr files.
Monitor newly constructed files that may establish persistence by executing malicious content triggered by user inactivity.
Monitor for changes made to files that may establish persistence by executing malicious content triggered by user inactivity.
Monitor newly executed processes that may establish persistence by executing malicious content triggered by user inactivity.
|DS0024||Windows Registry||Windows Registry Key Modification||
Monitor changes to screensaver configuration changes in the Registry that may not correlate with typical user behavior. Tools such as Sysinternals Autoruns can be used to detect changes to the screensaver binary path in the Registry.