huntrule

Windows: Registry Set by Rundll32 for Screen Saver Execution via SCRNSAVE.EXE

Flags Windows registry sets where Rundll32 points SCRNSAVE.EXE to a .scr file.

FreeReviewedSigma · Medium · v1
Product
windows
Category
registry_set
Author
Jose Luis Sanchez Martinez (@Joseliyo_Jstnk) (SigmaHQ), DRL 1.1
Published
2022-05-04
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies when Rundll32 is involved in creating a registry entry tied to the Control Panel\Desktop\SCRNSAVE.EXE setting, with Details indicating a .scr file. Such persistence or execution flow can be used by attackers to masquerade and load a screen saver payload. The detection relies on process image path suffix matching (rundll32.exe) and registry set telemetry that captures TargetObject and Details contents.

Reporting behind it

Related detections9 linkedT1218.011 — drag to rearrange
Suspicious rundll32 Executing DLL from ProgramData (via process_creation)
Suspicious Rundll32 Loading DLL From Public or ProgramData Path via Process Creation (via process_creation)
Malicious LSASS Credential Dump via Rundll32 Comsvcs MiniDump via Process Creation (via process_creation)
Suspicious Rundll32 Execution Without a DLL Reference via Process Creation (via process_creation)
Suspicious WebDAV Retrieval via rundll32 and davclnt.dll (via process_creation)
Suspicious Rundll32 Execution with Latrodectus Loader Exports (via process_creation)
Suspicious Rundll32 Execution with IcedID Loader Export (via process_creation)
Malicious Scheduled Task Running rundll32 w32analytics (via process_creation)
Suspicious StrelaStealer DLL Execution via Rundll32 Hello Export from Temp (via process_creation)
Windows: Registry Set by Rundll32 for Screen Saver Execution via SCRNSAVE.EXE
Pivot detection · T1218.011 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.