Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension. The Windows screensaver application…
Sub-technique of Event Triggered Execution (T1546).
T1546.002 Event Triggered Execution: Screensaver
title: "T1546.002 Event Triggered Execution: Screensaver"
id: f5014655-c265-4b77-a2bc-135908d6b7f2
description: 'Detects screensaver-based persistence via registry modification of HKCU\Control Panel\Desktop screensaver settings (SCRNSAVE.exe, ScreenSaveActive, ScreenSaverIsSecure, ScreenSaveTimeOut); the previous version matched HKCR file-association \shell\open\command keys, which is Change Default File Association (T1546.001) behavior, not Screensaver. Tune using: TimeWindow, SuspiciousPathRegex, ParentProcessAllowList, RegistryEditorProcessName.'
references:
- https://attack.mitre.org/techniques/T1546/002
author: Shahrukh Khan
date: 2026-06-06
license: MIT
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1546.002
logsource:
category: registry_set
product: windows
service: sysmon
detection:
selection:
TargetObject|contains: '\Control Panel\Desktop\'
TargetObject|endswith:
- '\SCRNSAVE.exe'
- '\ScreenSaveActive'
- '\ScreenSaverIsSecure'
- '\ScreenSaveTimeOut'
filter_default_apps:
Details|contains:
- '%SystemRoot%'
- '\Program Files\'
condition: selection and not filter_default_apps
falsepositives:
- Legitimate user-initiated screensaver configuration changes through Windows Settings; the filter excludes typical system/Program Files targets, but custom third-party screensavers will still need allowlisting.
level: high