SCR File Write Event

Status: test
Severity: medium
Log source: category file_event, product windows
Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io
Source: github.com/SigmaHQ/sigma

Detects the creation of screensaver files (.scr) outside of system folders. Attackers may execute an application as an ".SCR" file using "rundll32.exe desk.cpl,InstallScreenSaver" for example.

Known false positives

The installation of new screen savers by third party software

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1218.011` System Binary Proxy Execution: Rundll32

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule body

title: SCR File Write Event
id: c048f047-7e2a-4888-b302-55f509d4a91d
status: test
description: Detects the creation of screensaver files (.scr) outside of system folders. Attackers may execute an application as an ".SCR" file using "rundll32.exe desk.cpl,InstallScreenSaver" for example.
references:
    - https://lolbas-project.github.io/lolbas/Libraries/Desk/
author: 'Christopher Peacock @securepeacock, SCYTHE @scythe_io'
date: 2022-04-27
modified: 2023-08-23
tags:
    - attack.stealth
    - attack.t1218.011
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith: '.scr'
    filter:
        TargetFilename|contains:
            - ':\$WINDOWS.~BT\NewOS\'
            - ':\Windows\System32\'
            - ':\Windows\SysWOW64\'
            - ':\Windows\WinSxS\'
            - ':\WUDownloadCache\' # Windows Update Download Cache
    condition: selection and not filter
falsepositives:
    - The installation of new screen savers by third party software
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
    TargetFilename|endswith: '.scr'

Stage 2: `not filter`

filter:
    TargetFilename|contains:
        - ':\$WINDOWS.~BT\NewOS\'
        - ':\Windows\System32\'
        - ':\Windows\SysWOW64\'
        - ':\Windows\WinSxS\'
        - ':\WUDownloadCache\'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`TargetFilename`	match	`:\$WINDOWS.~BT\NewOS\`	`excludes:TargetFilename` `field:"TargetFilename" value:":\$WINDOWS.~BT\NewOS\"`
`TargetFilename`	match	`:\WUDownloadCache\`	`excludes:TargetFilename` `field:"TargetFilename" value:":\WUDownloadCache\"`
`TargetFilename`	match	`:\Windows\SysWOW64\`	`excludes:TargetFilename` `field:"TargetFilename" value:":\Windows\SysWOW64\"`
`TargetFilename`	match	`:\Windows\System32\`	`excludes:TargetFilename` `field:"TargetFilename" value:":\Windows\System32\"`
`TargetFilename`	match	`:\Windows\WinSxS\`	`excludes:TargetFilename` `field:"TargetFilename" value:":\Windows\WinSxS\"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetFilename`	ends_with	`.scr` corpus 8 (sigma 8)	`field:"TargetFilename" kind:ends_with value:".scr"`