MITRE ATT&CKsub-technique

T1546.002 Screensaver

Published 2020-01-24 Modified 2025-10-24 Official page ↗
Domain
enterprise
Tactics
Privilege Escalation, Persistence
Platforms
Windows
Version
1.3
Created
2020-01-24

Description

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension. The Windows screensaver application scrnsave.scr is located in C:\Windows\System32\, and C:\Windows\sysWOW64\ on 64-bit Windows systems, along with screensavers included with base Windows installations. The following screensaver settings are stored in the Registry (HKCU\Control Panel\Desktop\) and could be manipulated to achieve persistence: • SCRNSAVE.exe - set to malicious PE path • ScreenSaveActive - set to '1' to enable the screensaver • ScreenSaverIsSecure - set to '0' to not require a password to unlock • ScreenSaveTimeout - sets user inactivity timeout before screensaver is executed Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1546 Event Triggered Execution technique

Tactic · MITRE ATT&CK (2)

  • TA0003 Persistence tactic
  • TA0004 Privilege Escalation tactic

Referenced by MITRE ATT&CK · mitigates (2)

  • M1038 Execution Prevention mitigation
  • M1042 Disable or Remove Feature or Program mitigation

Referenced by MITRE ATT&CK · uses (1)

  • S0168 Gazer software (malware)

Referenced by Compliance · mitigates (10)

  • CIS-2.5 Allowlist Authorized Software CIS Safeguard v8.1
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SI-10 Information Input Validation NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References