Detection rules › Sigma

SCR File Write Event

Severity
medium
Author
Christopher Peacock @securepeacock, SCYTHE @scythe_io
Source
upstream

Detects the creation of screensaver files (.scr) outside of system folders. Attackers may execute an application as an ".SCR" file using "rundll32.exe desk.cpl,InstallScreenSaver" for example.

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1218.011 System Binary Proxy Execution: Rundll32

Event coverage

ProviderEvent IDTitle
Sysmon11FileCreate

Stages and Predicates

Stage 1: selection

TargetFilename|endswith: .scr

Stage 2: not filter

or:
TargetFilename|contains: ':\$WINDOWS.~BT\NewOS\'
TargetFilename|contains: ':\WUDownloadCache\'
TargetFilename|contains: ':\Windows\SysWOW64\'
TargetFilename|contains: ':\Windows\System32\'
TargetFilename|contains: ':\Windows\WinSxS\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
TargetFilenameends_with
  • .scr corpus 8 (sigma 8)
TargetFilenamematch
  • :\$WINDOWS.~BT\NewOS\
  • :\WUDownloadCache\
  • :\Windows\SysWOW64\
  • :\Windows\System32\
  • :\Windows\WinSxS\