{"id":"40b6e656-4e11-4c0c-8772-c1cc6dae34ce","title":"ScreenSaver Registry Key Set","description":"Detects registry key established after masqueraded .scr file execution using Rundll32 through desk.cpl","author":"Jose Luis Sanchez Martinez (@Joseliyo_Jstnk)","status":"test","level":"medium","date":"2022-05-04","modified":"2023-08-17","tags":["attack.stealth","attack.t1218.011"],"technique_ids":["T1218.011"],"logsource":{"product":"windows","category":"registry_set"},"falsepositives":["Legitimate use of screen saver"],"references":["https://twitter.com/VakninHai/status/1517027824984547329","https://twitter.com/pabraeken/status/998627081360695297","https://jstnk9.github.io/jstnk9/research/InstallScreenSaver-SCR-files"],"source_path":"rules/windows/registry/registry_set/registry_set_scr_file_executed_by_rundll32.yml","source_sha256":"90da4a70d30db0f6daa5b3a21e53ad0ed9ab10ac1c9a27d8094c6486ee00dbc1","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_set/registry_set_scr_file_executed_by_rundll32.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: ScreenSaver Registry Key Set\nid: 40b6e656-4e11-4c0c-8772-c1cc6dae34ce\nstatus: test\ndescription: Detects registry key established after masqueraded .scr file execution using Rundll32 through desk.cpl\nreferences:\n    - https://twitter.com/VakninHai/status/1517027824984547329\n    - https://twitter.com/pabraeken/status/998627081360695297\n    - https://jstnk9.github.io/jstnk9/research/InstallScreenSaver-SCR-files\nauthor: Jose Luis Sanchez Martinez (@Joseliyo_Jstnk)\ndate: 2022-05-04\nmodified: 2023-08-17\ntags:\n    - attack.stealth\n    - attack.t1218.011\nlogsource:\n    product: windows\n    category: registry_set\ndetection:\n    selection:\n        Image|endswith: '\\rundll32.exe'\n    registry:\n        TargetObject|contains: '\\Control Panel\\Desktop\\SCRNSAVE.EXE'\n        Details|endswith: '.scr'\n    filter:\n        Details|contains:\n            - 'C:\\Windows\\System32\\'\n            - 'C:\\Windows\\SysWOW64\\'\n    condition: selection and registry and not filter\nfalsepositives:\n    - Legitimate use of screen saver\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1218.011","id":"T1218.011","name":"Rundll32","page":"techniques/enterprise/T1218.011/"}],"data_path":"data/detection-rules/40b6e656-4e11-4c0c-8772-c1cc6dae34ce.json","kind":"sigma"}