Windows: Suspicious .scr ScreenSaver Binary File Creation

title: "Windows: Suspicious .scr ScreenSaver Binary File Creation"
id: a5263d2e-c94c-4f07-9a67-b006035fc440
status: test
description: This rule flags creation of Windows screen saver binaries by matching file events where the target filename ends with a .scr extension. Malicious actors can use screensaver execution triggered by user inactivity as a persistence mechanism, making anomalous .scr drops and writes a useful indicator. It relies on Windows file creation telemetry that includes the target filename and image/path context, excluding specific known benign installers and a particular TiWorker-related screen saver file.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.002/T1546.002.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_creation_scr_binary_file.yml
author: frack113, Huntrule Team
date: 2021-12-29
modified: 2022-11-08
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.002
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith: .scr
  filter_generic:
    Image|endswith:
      - \Kindle.exe
      - \Bin\ccSvcHst.exe
  filter_tiworker:
    Image|endswith: \TiWorker.exe
    TargetFilename|endswith: \uwfservicingscr.scr
  condition: selection and not 1 of filter_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 97aa2e88-555c-450d-85a6-229bcd87efb8
    type: derived