Path To Screensaver Binary Modified

Title: Path To Screensaver Binary Modified
Status: test
Description:Detects value modification of registry key containing path to binary used as screensaver.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.002/T1546.002.md
  -https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf
Author: Bartlomiej Czyz @bczyz1, oscd.community
Date: 2020-10-11
modified:2021-11-27
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.t1546.002'

Logsource:

• category: registry_event
• product: windows

Detection:
  selection:
    TargetObject|endswith: '\Control Panel\Desktop\SCRNSAVE.EXE'
  filter:
    Image|endswith:
      -'\rundll32.exe'
      -'\explorer.exe'

  condition:selection and not filter
Falsepositives:
  -Legitimate modification of screensaver
Level: medium