GazerS0168 ↗
Can establish persistence through the system screensaver by configuring it to execute the malware.1
- Tactics
- Persistence, Privilege Escalation
- Platform
- Windows
- Version
- 1.3
- Created
- 24 January 2020
- Last modified
- 24 October 2025
- Contributor
- Bartosz Jerzman
Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.[1] The Windows screensaver application scrnsave.scr is located in C:\Windows\System32\, and C:\Windows\sysWOW64\ on 64-bit Windows systems, along with screensavers included with base Windows installations.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.5
Detection rules64th pct
Detection rules64th percentile · 64% of ATT&CK techniques have this many detection rules written or fewer.Screensaver MITRE reference T1546.002
44th pctamong all ATT&CK techniques for number of tools
1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
All 1 software entries for this technique
Offense vs defense T1546.002
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 1
first rule: 2020 Q4Screensaver detection strategy DET0154
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Screensaver-Based Persistence via Registry and Execution Chains
1 platform
AN0441 · Windows
Unusual screensaver (.scr) executions correlated with recent registry modifications to HKCU\Control Panel\Desktop values such as SCRNSAVE.exe, ScreenSaveTimeout, and ScreenSaveActive. Detection focuses on PE image paths not consistent with known legitimate screensavers and triggered after user inactivity timeout.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| Windows Registry Key ModificationDC0063 | WinEventLog:Sysmon | EventCode=13, 14 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Adjust the user inactivity threshold that defines 'screensaver trigger window'; shorter timeouts may increase sensitivity. |
| SuspiciousPathRegex | Allow tuning based on expected paths for legitimate .scr files vs suspicious locations (e.g., user temp directories). |
| ParentProcessAllowList | Allowlisting known legitimate initiators of .scr files (e.g., user32.dll context) to reduce false positives. |
| RegistryEditorProcessName | Monitor for registry modification performed by unusual processes (e.g., powershell.exe, reg.exe). |
1 analytic
Adversaries may use screensaver files to run malicious code. This analytic triggers on suspicious edits to the screensaver registry keys, which dictate which .scr file the screensaver runs.
D3FEND techniques
The defensive countermeasure this analytic implements, in MITRE’s D3FEND ontology.
| ID | Name |
|---|---|
| D3-USICA | User Session Init Config Analysis |
Data model references
The CAR data model objects, actions and fields the logic reads. Map these to your own schema before implementing.
| Object | Action | Field |
|---|---|---|
| registry | edit | key |
| registry | add | key |
Implementations
Pseudocode is the canonical logic; the rest are CAR’s translations into vendor query languages.
This is a pseudocode representation of the below splunk search.
reg_events = search Registry:add or Registry:edit scr_reg_events = filter processes where ( key="*\\Software\\Policies\\Microsoft\\Windows\\Control Panel\\Desktop\\SCRNSAVE.EXE" AND output scr_reg_events
looks creations of edits of the SCRNSAVE.exe registry key
index=your_sysmon_index (EventCode=12 OR EventCode=13 OR EventCode=14) TargetObject="*\\Software\\Policies\\Microsoft\\Windows\\Control Panel\\Desktop\\SCRNSAVE.EXE"
looks creations of edits of the SCRNSAVE.exe registry key
norm_id=WindowsSysmon event_id IN [12, 13, 14] target_object="*\Software\Policies\Microsoft\Windows\Control Panel\Desktop\SCRNSAVE.EXE"
Use Group Policy to disable screensavers if they are unnecessary.
Execution PreventionM1038
Block .scr files from being executed from non-standard locations.
Tests1Executorscmd 1Need elevation1 of 1Have prerequisites0Have cleanup1Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition