MITRE CAR unknown stable spl

Registry Edit from Screensaver

Adversaries may use screensaver files to run malicious code. This analytic triggers on suspicious edits to the screensaver registry keys, which dictate which .scr file the screensaver runs.

View Source

Detection Logic

index=your_sysmon_index (EventCode=12 
OR EventCode=13 
OR EventCode=14) TargetObject="*\\Software\\Policies\\Microsoft\\Windows\\Control Panel\\Desktop\\SCRNSAVE.EXE"

Field Validations

Loading…

Comments (0)

Loading comments...