Windows: Suspicious .SCR Screensaver File Creation
Alerts on creation of new .scr screensaver binaries on Windows, excluding known benign paths and a specific TiWorker case.
- Product
- windows
- Category
- file_event
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-12-29
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags file creation events where the target filename ends with a .scr extension, consistent with Windows screensaver binaries. Attackers may use screensavers executed after user inactivity as a persistence mechanism. It relies on Windows file event telemetry that includes the created target filename and, where available, the creating process image path to filter known benign cases.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: Suspicious .SCR Screensaver File Creation"
id: a5263d2e-c94c-4f07-9a67-b006035fc440
status: test
description: This rule flags file creation events where the target filename ends with a .scr extension, consistent with Windows screensaver binaries. Attackers may use screensavers executed after user inactivity as a persistence mechanism. It relies on Windows file event telemetry that includes the created target filename and, where available, the creating process image path to filter known benign cases.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.002/T1546.002.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_creation_scr_binary_file.yml
author: frack113, Huntrule Team
date: 2021-12-29
modified: 2022-11-08
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1546.002
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|endswith: .scr
filter_generic:
Image|endswith:
- \Kindle.exe
- \Bin\ccSvcHst.exe
filter_tiworker:
Image|endswith: \TiWorker.exe
TargetFilename|endswith: \uwfservicingscr.scr
condition: selection and not 1 of filter_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 97aa2e88-555c-450d-85a6-229bcd87efb8
type: derived