{"id":"15bd98ea-55f4-4d37-b09a-e7caa0fa2221","title":"Rundll32 InstallScreenSaver Execution","description":"An attacker may execute an application as a SCR File using rundll32.exe desk.cpl,InstallScreenSaver","author":"Christopher Peacock @securepeacock, SCYTHE @scythe_io, TactiKoolSec","status":"test","level":"medium","date":"2022-04-28","modified":"2023-02-09","tags":["attack.stealth","attack.t1218.011"],"technique_ids":["T1218.011"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate installation of a new screensaver"],"references":["https://lolbas-project.github.io/lolbas/Libraries/Desk/","https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1218.011/T1218.011.md#atomic-test-13---rundll32-with-deskcpl"],"source_path":"rules/windows/process_creation/proc_creation_win_rundll32_installscreensaver.yml","source_sha256":"28fd1ceb1afd8e720dfc58181d803eefd4be165f1e2317e02169822a2cb51c49","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_rundll32_installscreensaver.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Rundll32 InstallScreenSaver Execution\nid: 15bd98ea-55f4-4d37-b09a-e7caa0fa2221\nstatus: test\ndescription: An attacker may execute an application as a SCR File using rundll32.exe desk.cpl,InstallScreenSaver\nreferences:\n    - https://lolbas-project.github.io/lolbas/Libraries/Desk/\n    - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1218.011/T1218.011.md#atomic-test-13---rundll32-with-deskcpl\nauthor: 'Christopher Peacock @securepeacock, SCYTHE @scythe_io, TactiKoolSec'\ndate: 2022-04-28\nmodified: 2023-02-09\ntags:\n    - attack.stealth\n    - attack.t1218.011\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\rundll32.exe'\n        - OriginalFileName: 'RUNDLL32.EXE'\n    selection_cli:\n        CommandLine|contains: 'InstallScreenSaver'\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate installation of a new screensaver\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1218.011","id":"T1218.011","name":"Rundll32","page":"techniques/enterprise/T1218.011/"}],"data_path":"data/detection-rules/15bd98ea-55f4-4d37-b09a-e7caa0fa2221.json","kind":"sigma"}