t1546-002-screensaver

name	T1546.002_screensaver
description	Adversaries may establish persistence by executing malicious content triggered by user inactivity.
category	authorization
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1546.002","privilege-escalation","persistence","windows","sub-technique"]
technique_id	T1546.002
tactic	privilege-escalation
all_tactics	["privilege-escalation","persistence"]
platforms	["Windows"]
mitre_url	https://attack.mitre.org/techniques/T1546/002
tech_stack	["windows"]
cwe_ids	["CWE-269"]
chains_with	["T1546","T1546.001","T1546.003","T1546.004","T1546.005","T1546.006","T1546.007","T1546.008","T1546.009","T1546.010","T1546.011","T1546.012","T1546.013","T1546.014","T1546.015","T1546.016","T1546.017","T1546.018"]
prerequisites	["T1546"]
severity_boost	{"T1546":"Chain with T1546 for deeper attack path","T1546.001":"Chain with T1546.001 for deeper attack path","T1546.003":"Chain with T1546.003 for deeper attack path"}

T1546.002 Screensaver

Sub-technique of: T1546

High-Level Description

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension. The Windows screensaver application scrnsave.scr is located in C:\Windows\System32</code>, and C:\Windows\sysWOW64</code> on 64-bit Windows systems, along with screensavers included with base Windows installations.

The following screensaver settings are stored in the Registry (HKCU\Control Panel\Desktop</code>) and could be manipulated to achieve persistence:

• SCRNSAVE.exe - set to malicious PE path
• ScreenSaveActive - set to '1' to enable the screensaver
• ScreenSaverIsSecure - set to '0' to not require a password to unlock
• ScreenSaveTimeout - sets user inactivity timeout before screensaver is executed

Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity.

Kill Chain Phase

• Privilege Escalation (TA0004)
• Persistence (TA0003)

Platforms: Windows

What to Check

• Identify if Screensaver technique is applicable to target environment
• Check Windows systems for indicators of Screensaver
• Verify mitigations are bypassed or absent (2 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Set Arbitrary Binary as Screensaver

This test copies a binary into the Windows System32 folder and sets it as the screensaver so it will execute for persistence. Requires a reboot and logon.

Supported Platforms: windows Elevation Required: Yes