Windows: Detect .SCR screen saver file creation outside common system directories

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1218.011Rundll32
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags file creation events where the target filename ends with .scr and the file is not located in typical Windows system folders. Creating screensaver files in unusual paths can be used to stage or execute code under the screensaver file extension. It relies on Windows file event telemetry that includes the target filename for write/create operations.

Reporting behind it

Related detections9 linkedT1218.011 — drag to rearrange

Malicious Zardoor Backdoor Execution via rundll32 (via process_creation)

Malicious Rundll32 Loading an Export From a User Path (via process_creation)

Renamed Regsvr32 or Rundll32 Loading a DLL With a Non-Standard Extension (via process_creation)

Malicious Rundll32 DllRegisterServer Execution From a User-Writable Path (via process_creation)

IMEEX Framework DLL Execution via Rundll32 Loading imaadp (via process_creation)

Suspicious Persistence via pcalua Launching rundll32 Control_RunDLL

Suspicious Rundll32 Executing DLL Start Export With Control Flags

Suspicious Rundll32 Execution of Timestamp-Named DLL

Suspicious Rundll32 Loading DLL from LocalAppData with Short Export (via process_creation)

Windows: Detect .SCR screen saver file creation outside common system directories

Pivot detection · T1218.011 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-scr-screen-saver-file-created-outside-system-directories-c048f047

title: "Windows: Detect .SCR screen saver file creation outside common system directories"
id: b98685e1-19c1-47e6-8e75-3202d82d103d
status: test
description: This rule flags file creation events where the target filename ends with .scr and the file is not located in typical Windows system folders. Creating screensaver files in unusual paths can be used to stage or execute code under the screensaver file extension. It relies on Windows file event telemetry that includes the target filename for write/create operations.
references:
  - https://lolbas-project.github.io/lolbas/Libraries/Desk/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_new_scr_file.yml
author: Christopher Peacock @securepeacock, SCYTHE @scythe_io, Huntrule Team
date: 2022-04-27
modified: 2023-08-23
tags:
  - attack.stealth
  - attack.t1218.011
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: .scr
  filter:
    TargetFilename|contains:
      - :\$WINDOWS.~BT\NewOS\
      - :\Windows\System32\
      - :\Windows\SysWOW64\
      - :\Windows\WinSxS\
      - :\WUDownloadCache\
  condition: selection and not filter
falsepositives:
  - The installation of new screen savers by third party software
level: medium
license: DRL-1.1
related:
  - id: c048f047-7e2a-4888-b302-55f509d4a91d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL