Registry Edit from Screensaver

Hypothesis and description

Adversaries may use screensaver files to run malicious code. This analytic triggers on suspicious edits to the screensaver registry keys, which dictate which .scr file the screensaver runs.

Platforms: Windows
Domain: Host
Subtypes: Process
Submitted: 2020-11-30
Contributors: Olaf Hartong

ATT&CK coverage

Technique	Tactics	Coverage
T1546 Event Triggered ExecutionT1546.002	Persistence, Privilege Escalation	High

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1546Event Triggered Execution
.002 Screensaver

D3FEND techniques MITRE maps to this analytic

D3-USICA User Session Init Config Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

PseudocodePseudocode - ScreensaverData model: CAR native

This is a pseudocode representation of the below splunk search.

reg_events = search Registry:add or Registry:edit
scr_reg_events = filter processes where (
  key="*\\Software\\Policies\\Microsoft\\Windows\\Control Panel\\Desktop\\SCRNSAVE.EXE" AND
output scr_reg_events

SplunkSplunk Search - ScreensaverData model: Sysmon native

looks creations of edits of the SCRNSAVE.exe registry key

index=your_sysmon_index (EventCode=12 OR EventCode=13 OR EventCode=14) TargetObject="*\\Software\\Policies\\Microsoft\\Windows\\Control Panel\\Desktop\\SCRNSAVE.EXE"

LogPointLogPoint Search - ScreensaverData model: LogPoint native

looks creations of edits of the SCRNSAVE.exe registry key

norm_id=WindowsSysmon event_id IN [12, 13, 14] target_object="*\Software\Policies\Microsoft\Windows\Control Panel\Desktop\SCRNSAVE.EXE"

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

38 more in the full list

View CAR-2020-11-011 on car.mitre.org

TTPCAR-2020-11-011

Registry Edit from Screensaver

Hypothesis and description

Adversaries may use screensaver files to run malicious code. This analytic triggers on suspicious edits to the screensaver registry keys, which dictate which .scr file the screensaver runs.

Platforms: Windows
Domain: Host
Subtypes: Process
Submitted: 2020-11-30
Contributors: Olaf Hartong

ATT&CK coverage

Technique	Tactics	Coverage
T1546 Event Triggered ExecutionT1546.002	Persistence, Privilege Escalation	High

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1546Event Triggered Execution
.002 Screensaver

D3FEND techniques MITRE maps to this analytic

D3-USICA User Session Init Config Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

PseudocodePseudocode - ScreensaverData model: CAR native

This is a pseudocode representation of the below splunk search.

reg_events = search Registry:add or Registry:edit
scr_reg_events = filter processes where (
  key="*\\Software\\Policies\\Microsoft\\Windows\\Control Panel\\Desktop\\SCRNSAVE.EXE" AND
output scr_reg_events

SplunkSplunk Search - ScreensaverData model: Sysmon native

looks creations of edits of the SCRNSAVE.exe registry key

index=your_sysmon_index (EventCode=12 OR EventCode=13 OR EventCode=14) TargetObject="*\\Software\\Policies\\Microsoft\\Windows\\Control Panel\\Desktop\\SCRNSAVE.EXE"

LogPointLogPoint Search - ScreensaverData model: LogPoint native

looks creations of edits of the SCRNSAVE.exe registry key

norm_id=WindowsSysmon event_id IN [12, 13, 14] target_object="*\Software\Policies\Microsoft\Windows\Control Panel\Desktop\SCRNSAVE.EXE"

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

38 more in the full list

View CAR-2020-11-011 on car.mitre.org