Windows: Detect reg.exe Changing Screen Saver Registry Settings for .scr Payloads
Flags reg.exe command lines that modify HKCU desktop screensaver settings and configure a .scr screen saver payload.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-08-19
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies executions of reg.exe whose command line targets the current user desktop screensaver-related registry keys and sets ScreenSaveActive, ScreenSaveTimeout, and ScreenSaverIsSecure. It further matches registry value changes that reference an executables path ending in .scr via the SCRNSAVE.EXE value. Such behavior matters because it can allow an attacker to configure a user inactivity screen saver to run malicious content. The detection relies on Windows process creation telemetry including the process image path and full command-line arguments.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.002/T1546.002.md
- welivesecurity.comhttps://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_screensaver.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Detect reg.exe Changing Screen Saver Registry Settings for .scr Payloads"
id: 7c8a256e-2028-4152-8cf0-bafeb4f4468a
status: test
description: This rule identifies executions of reg.exe whose command line targets the current user desktop screensaver-related registry keys and sets ScreenSaveActive, ScreenSaveTimeout, and ScreenSaverIsSecure. It further matches registry value changes that reference an executables path ending in .scr via the SCRNSAVE.EXE value. Such behavior matters because it can allow an attacker to configure a user inactivity screen saver to run malicious content. The detection relies on Windows process creation telemetry including the process image path and full command-line arguments.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.002/T1546.002.md
- https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_screensaver.yml
author: frack113, Huntrule Team
date: 2021-08-19
modified: 2022-06-02
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1546.002
logsource:
category: process_creation
product: windows
detection:
selection_reg:
Image|endswith: \reg.exe
CommandLine|contains:
- HKEY_CURRENT_USER\Control Panel\Desktop
- HKCU\Control Panel\Desktop
selection_option_1:
CommandLine|contains|all:
- /v ScreenSaveActive
- /t REG_SZ
- /d 1
- /f
selection_option_2:
CommandLine|contains|all:
- /v ScreenSaveTimeout
- /t REG_SZ
- "/d "
- /f
selection_option_3:
CommandLine|contains|all:
- /v ScreenSaverIsSecure
- /t REG_SZ
- /d 0
- /f
selection_option_4:
CommandLine|contains|all:
- /v SCRNSAVE.EXE
- /t REG_SZ
- "/d "
- .scr
- /f
condition: selection_reg and 1 of selection_option_*
falsepositives:
- GPO
level: medium
license: DRL-1.1
related:
- id: 0fc35fc3-efe6-4898-8a37-0b233339524f
type: derived