Suspicious ScreenSaver Registry Key Set (via registry_set)

title: Suspicious ScreenSaver Registry Key Set (via registry_set)
id: a0b63aa3-869f-5aa9-875c-5e694306eafe
status: stable
description: This rule detects registry key established after masqueraded .scr file execution using Rundll32 through desk.cpl
references:
    - https://attack.mitre.org/techniques/T1218/011/
    - https://twitter.com/VakninHai/status/1517027824984547329
    - https://twitter.com/pabraeken/status/998627081360695297
    - https://jstnk9.github.io/jstnk9/research/InstallScreenSaver-SCR-files
author: Huntrule Team
date: 2026-03-07
tags:
    - attack.stealth
    - attack.t1218.011
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        Image|endswith: '\rundll32.exe'
    registry:
        TargetObject|contains: '\Control Panel\Desktop\SCRNSAVE.EXE'
        Details|endswith: '.scr'
    filter:
        Details|contains:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
    condition: selection and registry and not filter
falsepositives:
    - Unknown
level: medium