Detect Screensaver in Google Chronicle
Adversaries may establish persistence by modifying the Windows screensaver configuration. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension. Adversaries can abuse this by modifying the SCRNSAVE.EXE registry value in HKCU\Control Panel\Desktop to point to a malicious executable that runs whenever the screen saver activates.
MITRE ATT&CK
- Tactic
- Privilege Escalation Persistence
- Technique
- T1546 Event Triggered Execution
- Sub-technique
- T1546.002 Screensaver
- Canonical reference
- https://attack.mitre.org/techniques/T1546/002/
YARA-L Detection Query
rule screensaver_persistence_t1546_002 {
meta:
author = "Argus Detection Engineering"
description = "Detects T1546.002: Adversaries modifying Windows screensaver registry keys to achieve persistence via SCRNSAVE.EXE or related values pointing to malicious executables"
mitre_attack_technique = "T1546.002"
mitre_attack_tactic = "Privilege Escalation, Persistence"
severity = "HIGH"
confidence = "HIGH"
created = "2026-04-20"
events:
$e.metadata.event_type = "REGISTRY_MODIFICATION"
$e.target.registry.registry_key = /Control Panel\\Desktop/i
(
$e.target.registry.registry_value_name = /^SCRNSAVE\.EXE$/i or
$e.target.registry.registry_value_name = /^ScreenSaveActive$/i or
$e.target.registry.registry_value_name = /^ScreenSaverIsSecure$/i or
$e.target.registry.registry_value_name = /^ScreenSaveTimeOut$/i
)
(
re.regex($e.target.registry.registry_value_data, `(?i)(appdata|\\temp\\|programdata|\\public\\|powershell|cmd\.exe|wscript|cscript|rundll32)`) or
(
$e.target.registry.registry_value_name = /^SCRNSAVE\.EXE$/i and
not re.regex($e.target.registry.registry_value_data, `(?i)c:\\windows\\(system32|syswow64)\\`) and
$e.target.registry.registry_value_data != ""
)
)
condition:
$e
}Chronicle YARA-L 2.0 rule detecting T1546.002 screensaver persistence by monitoring UDM REGISTRY_MODIFICATION events targeting Windows screensaver configuration keys. Triggers when SCRNSAVE.EXE is redirected outside trusted system directories or when screensaver registry values reference suspicious staging paths or interpreter binaries.
Data Sources
Required Tables
False Positives & Tuning
- Enterprise screensaver deployment via Intune or Active Directory Group Policy updating SCRNSAVE.EXE to a corporate-branded .scr stored in %ProgramFiles%
- Legitimate power management software modifying ScreenSaveActive or ScreenSaveTimeOut to optimize battery or display behavior
- Security compliance tooling setting ScreenSaverIsSecure=1 as part of CIS benchmark enforcement scripts running from %ProgramData% or %AppData%
Other platforms for T1546.002
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Set Malicious Screensaver Path in Registry
Expected signal: Sysmon Event ID 13 (Registry Value Set) for HKCU\Control Panel\Desktop\SCRNSAVE.EXE with Details=C:\Windows\System32\cmd.exe. Additional Event ID 13 records for ScreenSaveActive and ScreenSaveTimeOut. Security Event ID 4657 if registry auditing is enabled.
- Test 2Disable Screensaver Lock Screen for Silent Execution
Expected signal: Sysmon Event ID 13: TargetObject HKCU\Control Panel\Desktop\ScreenSaverIsSecure, Details=0. This should be correlated with concurrent SCRNSAVE.EXE changes.
- Test 3Deploy Fake Screensaver via AppData
Expected signal: Sysmon Event ID 11 (File Created): malicious.scr in AppData path. Sysmon Event ID 13: SCRNSAVE.EXE value set to AppData path. Both the file creation and registry modification events fire. The AppData path in the registry value is the primary detection trigger.
Unlock Pro Content
Get the full detection package for T1546.002 including response playbook, investigation guide, and atomic red team tests.