Detection rules › Sigma

Suspicious Screensaver Binary File Creation

Severity
medium
Author
frack113
Source
upstream

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1546.002 Event Triggered Execution: Screensaver
Privilege EscalationT1546.002 Event Triggered Execution: Screensaver

Event coverage

ProviderEvent IDTitle
Sysmon11FileCreate

Stages and Predicates

Stage 1: selection

TargetFilename|endswith: .scr

Stage 2: not 1 of filter_*

or:
Image|endswith: '\TiWorker.exe'
TargetFilename|endswith: '\uwfservicingscr.scr'
Image|endswith: '\Bin\ccSvcHst.exe'
Image|endswith: '\Kindle.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Imageends_with
  • \Bin\ccSvcHst.exe
  • \Kindle.exe
  • \TiWorker.exe corpus 7 (sigma 7)
TargetFilenameends_with
  • .scr corpus 8 (sigma 8)
  • \uwfservicingscr.scr