ScreenSaver Registry Key Set

Title: ScreenSaver Registry Key Set
Status: test
Description:Detects registry key established after masqueraded .scr file execution using Rundll32 through desk.cpl
References:
  -https://twitter.com/VakninHai/status/1517027824984547329
  -https://twitter.com/pabraeken/status/998627081360695297
  -https://jstnk9.github.io/jstnk9/research/InstallScreenSaver-SCR-files
Author: Jose Luis Sanchez Martinez (@Joseliyo_Jstnk)
Date: 2022-05-04
modified:2023-08-17
Tags:

• -'attack.stealth'
• -'attack.t1218.011'

Logsource:

• product: windows
• category: registry_set

Detection:
  selection:
    Image|endswith: '\rundll32.exe'
  registry:
    TargetObject|contains: '\Control Panel\Desktop\SCRNSAVE.EXE'
    Details|endswith: '.scr'
  filter:
    Details|contains:
      -'C:\Windows\System32\'
      -'C:\Windows\SysWOW64\'

  condition:selection and registry and not filter
Falsepositives:
  -Legitimate use of screen saver
Level: medium