Screensaver registry value pointed at a user-writable path

Siemphony@siemphonymediumT1546.002unverified

Matches a registry SetValue on the SCRNSAVE.EXE value under Control Panel\Desktop where the value data points into a location a user-context process can write, which is the persistence half of AN0441 — that value names the PE Windows launches after the inactivity timeout, so the write itself carries the payload path. The other three values MITRE lists (ScreenSaveActive, ScreenSaverIsSecure, ScreenSaveTimeout) are DWORDs whose Details field holds no path at all, so they cannot support the data gate that makes this rule specific and are left out. The endswith term deliberately covers both the per-user preference key, which Sysmon records as HKU\<SID>\Control Panel\Desktop\SCRNSAVE.EXE rather than under HKCU, and the Software\Policies mirror of the same value; the path list is MITRE's SuspiciousPathRegex knob populated here with user-writable directories, so a screensaver left under System32 or Program Files never matches. Prerequisite: Sysmon EventID 13 is only emitted where the running configuration carries a RegistryEvent SetValue rule covering Control Panel\Desktop, and registry events are the most aggressively trimmed section of the widely used community configs, so an empty result here can mean blind rather than clean. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0154, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceRegistryEvents| where (RegistryKey endswith "\\Control Panel\\Desktop\\SCRNSAVE.EXE" and (RegistryValueData contains "\\Users\\" or RegistryValueData contains "\\AppData\\" or RegistryValueData contains "\\ProgramData\\" or RegistryValueData contains "\\Windows\\Temp\\" or RegistryValueData contains "\\PerfLogs\\" or RegistryValueData contains "\\$Recycle.Bin\\"))

Splunk · SPL

Run this as a search.

index=* (TargetObject="*\\Control Panel\\Desktop\\SCRNSAVE.EXE" AND (Details="*\\Users\\*" OR Details="*\\AppData\\*" OR Details="*\\ProgramData\\*" OR Details="*\\Windows\\Temp\\*" OR Details="*\\PerfLogs\\*" OR Details="*\\$Recycle.Bin\\*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(registry.path) LIKE "*\\\\control panel\\\\desktop\\\\scrnsave.exe" AND (TO_LOWER(registry.data.strings) LIKE "*\\\\users\\\\*" OR TO_LOWER(registry.data.strings) LIKE "*\\\\appdata\\\\*" OR TO_LOWER(registry.data.strings) LIKE "*\\\\programdata\\\\*" OR TO_LOWER(registry.data.strings) LIKE "*\\\\windows\\\\temp\\\\*" OR TO_LOWER(registry.data.strings) LIKE "*\\\\perflogs\\\\*" OR TO_LOWER(registry.data.strings) LIKE "*\\\\$recycle.bin\\\\*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,registry_set,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="TargetObject" type="pcre2">(?i)\\Control Panel\\Desktop\\SCRNSAVE\.EXE$</field>    <field name="Details" type="pcre2">(?i)(\\Users\\|\\AppData\\|\\ProgramData\\|\\Windows\\Temp\\|\\PerfLogs\\|\\\$Recycle\.Bin\\)</field>    <description>Screensaver registry value pointed at a user-writable path</description>    <mitre>      <id>T1546.002</id>    </mitre>  </rule></group>

At a glance

Logsource: registry_set / windows
Level: medium
Category: registry_persistence
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 8e6838bb-bbcf-4444-b97b-83362b354ef4

ATT&CKT1546.002

T1546.002Screensaver

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonregistry persistence

registry persistenceAI draft — unreviewed

01 · What this rule detects

AN0441 describes a chain: registry writes to HKCU\Control Panel\Desktop values, correlated with execution of a .scr image after the inactivity timeout. This rule implements only the registry half — a Sysmon SetValue on SCRNSAVE.EXE whose data points somewhere a user-context process can write. That value is the one MITRE lists that names an executable path directly, so the write itself carries the payload location; the other three values MITRE names (ScreenSaveActive, ScreenSaverIsSecure, ScreenSaveTimeout) are DWORDs with no path in their Details field and can't support this rule's logic, so they're left out entirely. The .scr execution half of AN0441 is not implemented here — the review notes this is left on the table as the natural companion rule.

02 · Telemetry you need

Sysmon EventID 13, category: registry_set / product: windows. Registry events are among the most aggressively trimmed sections of widely used community Sysmon configs, and this rule's own description states the prerequisite plainly: an empty result can mean the RegistryEvent SetValue section excludes Control Panel\Desktop rather than that nothing happened. Sentinel has no table modelled for registry_set, so three of four backends render.
Of AN0441's four knobs, only SuspiciousPathRegex is implementable on this logsource — TimeWindow and ParentProcessAllowList need the execution join this rule doesn't attempt, and RegistryEditorProcessName needs a process field this registry event doesn't carry.

03 · How the logic works

Two selections, ANDed. selection_screensaver_value matches TargetObject|endswith: '\Control Panel\Desktop\SCRNSAVE.EXE' — unanchored on purpose, because Sysmon renders the per-user key as HKU\<SID>\Control Panel\Desktop\SCRNSAVE.EXE rather than under HKCU, and the same endswith also catches the Software\Policies mirror of the value. selection_user_writable_payload matches Details|contains against six path fragments: \Users\, \AppData\, \ProgramData\, \Windows\Temp\, \PerfLogs\, \$Recycle.Bin\. This is MITRE's SuspiciousPathRegex knob — MITRE names the tuning field, this specific list of user-writable directories is the rule author's own choice, not something the brief supplied.

04 · Common false positives

The review's central finding is a logic gap, not just a volume problem: the Details gate assumes a fully expanded path, but SCRNSAVE.EXE is routinely written as REG_EXPAND_SZ, and Sysmon logs Details unexpanded. A payload at %APPDATA%\evil.scr — landing in exactly the directory this rule was built to catch — contains none of the six literal fragments and never matches. A UNC path misses the same way.
On the volume side, the first false positive is self-labelled "the highest- volume match by a wide margin": Group Policy Preferences re-applies a branded screensaver from a ProgramData staging folder on every policy refresh, on every domain-joined host. The review questions whether this is even the true loudest source, since GPP-deployed screensavers often point at System32 or a UNC path, neither of which satisfies the gate as written — while the Policies-mirror rewrite this rule deliberately includes goes unmentioned in the false-positive block entirely.

05 · Detection maturity

tier_1: . Derived from a MITRE scaffold with no query logic, never run against a log line.
tier_2: run read-only, rank hits by the expanded `Details` value, and confirm whether GPP or the true top false positive dominates before setting exclusions.
tier_3: ** pair this registry rule with the missing .scr-execution companion so an alert means persistence established and triggered, not a value write alone.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add expansion-aware terms to the Details list: %APPDATA%,
Verify which false positive is actually loudest before trusting `level:
Note the case-sensitivity gap on the Splunk backend: a value written as
Build the .scr execution rule (process_creation, image ending .scr,

Declared by the author

A corporate branded or compliance screensaver deployed by Group Policy Preferences from a staging folder under ProgramData. GPP registry items re-apply on every policy refresh by default, so in an estate that ships one this is the highest-volume match by a wide margin and it lands on every domain-joined host; suppress it on the specific Details value rather than by removing ProgramData, which is also where an operator would stage.
Endpoint-management and software-distribution agents that set the screensaver as part of a desktop-configuration baseline, writing the value once per host at enrolment and again whenever the baseline is re-evaluated.
A user picking a third-party screensaver that installed into their own profile — themed and photo screensavers routinely unpack under AppData rather than into System32, and the Screen Saver Settings dialog then stores that profile path verbatim.
User-state migration and roaming-profile tooling replaying a captured Control Panel\Desktop hive into a new profile, which reproduces the original SCRNSAVE.EXE value including its per-user path.

Noise check0 of 6 fired

Fires on none of the 6 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 6 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1546.002, evaluated against their registry_set events.

Share this rule

/u/siemphony/8e6838bb-bbcf-4444-b97b-83362b354ef4

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Screensaver registry value pointed at a user-writable path

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it