Desk.cpl

Launch an executable with a .scr extension by calling the InstallScreenSaver function.

Use Launch any executable payload, as long as it uses the .scr extension.

rundll32.exe desk.cpl,InstallScreenSaver {PATH_ABSOLUTE:.scr}

Context

user

Native

Execute

MITRE

T1218.011

Detection

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/file/file_event/file_event_win_new_src_file.yml

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_rundll32_installscreensaver.yml

Sigma: github.com/SigmaHQ/sigma/blob/940f89d43dbac5b7108610a5bde47cda0d2a643b/rules/windows/registry/registry_set/registry_set_scr_file_executed_by_rundll32.yml

Refs

vxug.fakedoma.in/zines/29a/29a7/Articles/29A-7.030.txt

twitter.com/pabraeken/status/998627081360695297

twitter.com/VakninHai/status/1517027824984547329

jstnk9.github.io/jstnk9/research/InstallScreenSaver-SCR-files

lolbas-project.github.io/lolbas/Libraries/Desk/

Launch a remote executable with a .scr extension, located on an SMB share, by calling the InstallScreenSaver function.

Use Launch any executable payload, as long as it uses the .scr extension.

rundll32.exe desk.cpl,InstallScreenSaver {PATH_SMB:.scr}

Context

user

Native

Execute

MITRE

T1218.011

Detection

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/file/file_event/file_event_win_new_src_file.yml

Sigma: github.com/SigmaHQ/sigma/blob/683b63f8184b93c9564c4310d10c571cbe367e1e/rules/windows/process_creation/proc_creation_win_lolbin_rundll32_installscreensaver.yml

Sigma: github.com/SigmaHQ/sigma/blob/940f89d43dbac5b7108610a5bde47cda0d2a643b/rules/windows/registry/registry_set/registry_set_scr_file_executed_by_rundll32.yml

Refs

vxug.fakedoma.in/zines/29a/29a7/Articles/29A-7.030.txt

twitter.com/pabraeken/status/998627081360695297

twitter.com/VakninHai/status/1517027824984547329

jstnk9.github.io/jstnk9/research/InstallScreenSaver-SCR-files

lolbas-project.github.io/lolbas/Libraries/Desk/