Skip to content

Latest commit

 

History

History
51 lines (34 loc) · 2.83 KB

T1180.md

File metadata and controls

51 lines (34 loc) · 2.83 KB

T1180 - Screensaver

Description from ATT&CK

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension. (Citation: Wikipedia Screensaver) The Windows screensaver application scrnsave.exe is located in C:\Windows\System32\ along with screensavers included with base Windows installations. The following screensaver settings are stored in the Registry (HKCU\Control Panel\Desktop\) and could be manipulated to achieve persistence:

*SCRNSAVE.exe - set to malicious PE path *ScreenSaveActive - set to '1' to enable the screensaver *ScreenSaverIsSecure - set to '0' to not require a password to unlock *ScreenSaverTimeout - sets user inactivity timeout before screensaver is executed

Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity. (Citation: ESET Gazer Aug 2017)

Detection: Monitor process execution and command-line parameters of .scr files. Monitor changes to screensaver configuration changes in the Registry that may not correlate with typical user behavior.

Tools such as Sysinternals Autoruns can be used to detect changes to the screensaver binary path in the Registry. Suspicious paths and PE files may indicate outliers among legitimate screensavers in a network and should be investigated.

Platforms: Windows

Data Sources: Process Monitoring, Process command-line parameters, Windows Registry, File monitoring

Permissions Required: User

Contributors: Bartosz Jerzman

Atomic Tests


Atomic Test #1 - Set Arbitrary Binary as Screensaver

This test copies a binary into the Windows System32 folder and sets it as the screensaver so it will execute for persistence. Requires a reboot and logon.

Supported Platforms: Windows

Inputs

Name Description Type Default Value
input_binary Executable binary to use in place of screensaver for persistence path C:\Windows\System32\cmd.exe

Run it with command_prompt!

copy #{input_binary} "%SystemRoot%\System32\evilscreensaver.scr"
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d 1 /f
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaverTimeout /t REG_SZ /d 60 /f
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaverIsSecure /t REG_SZ /d 0 /f
reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d "%SystemRoot%\System32\evilscreensaver.scr" /f
shutdown /r /t 0