T1546.002 Screensaver

Technique: T1546.002
Tactics: Privilege Escalation, Persistence
Research, 90 days: 1
KEV CVEs mapped: 0
SigmaHQ rules: 4
Elastic, Splunk: 4
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1546/002

MITRE description

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.(Citation: Wikipedia Screensaver) The Windows screensaver application scrnsave.scr is located in <code>C:\Windows\System32\</code>, and <code>C:\Windows\sysWOW64\</code> on 64-bit Windows systems, along with screensavers included with base Windows installations. The following screensaver settings are stored in the Registry (<code>HKCU\Control Panel\Desktop\</code>) and could be manipulated to achieve persistence: * <code>SCRNSAVE.exe</code> - set to malicious PE path * <code>ScreenSaveActive</code> - set to '1' to enable the screensaver * <code>ScreenSaverIsSecure</code> - set to '0' to not require a password to unlock * <code>ScreenSaveTimeout</code> - sets user inactivity timeout before screensaver is executed Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity.(Citation: ESET Gazer Aug 2017)

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-08-13 Recorded Future Insikt: Malware Crypting Services and the Threat Actors Who Sell Them

Detection coverage

SigmaHQ community rules

Suspicious Screensaver Binary File Creation (core)
Writing Local Admin Share (core)
Suspicious ScreenSave Change by Reg.exe (core)
Path To Screensaver Binary Modified (core)

Elastic and Splunk rules

Unexpected Child Process of macOS Screensaver Engine (elastic)
Screensaver Plist File Modified by Unexpected Process (elastic)
Uncommon Registry Persistence Change (elastic)
Screensaver Event Trigger Execution (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.