Windows: .SCR Screen Saver File Created Outside System Directories

title: "Windows: .SCR Screen Saver File Created Outside System Directories"
id: b98685e1-19c1-47e6-8e75-3202d82d103d
status: test
description: This rule flags file write events where the target filename ends with .scr, excluding common Windows system and update-related folders. Creating screen saver files in non-standard locations can be used for stealth and persistence by masquerading as legitimate screen saver content. It relies on Windows file event telemetry that records the target filename/path of the write operation and filters out known benign directories.
references:
  - https://lolbas-project.github.io/lolbas/Libraries/Desk/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_new_scr_file.yml
author: Christopher Peacock @securepeacock, SCYTHE @scythe_io, Huntrule Team
date: 2022-04-27
modified: 2023-08-23
tags:
  - attack.stealth
  - attack.t1218.011
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: .scr
  filter:
    TargetFilename|contains:
      - :\$WINDOWS.~BT\NewOS\
      - :\Windows\System32\
      - :\Windows\SysWOW64\
      - :\Windows\WinSxS\
      - :\WUDownloadCache\
  condition: selection and not filter
falsepositives:
  - The installation of new screen savers by third party software
level: medium
license: DRL-1.1
related:
  - id: c048f047-7e2a-4888-b302-55f509d4a91d
    type: derived