Query: Sigma rule for Detects the creation of screensaver files (.scr) outside of system folders. Attackers may execute an application as an "
Matching passage: Sigma rule: Detects the creation of screensaver files (.scr) outside of system folders. Attackers may execute an application as an ". Logsource: windows / file_event. Rule: title: SCR File Write Event id: c048f047-7e2a-4888-b302-55f509d4a91d status: test description: Detects the creation of screensaver files (.scr) outside of system folders. Attackers may execute an application as an ".SCR" file using "rundll32.exe desk.cpl,InstallScreenSaver" for example. references: - https://lolbas-project.github.io/lolbas/Libraries/Desk/ author: Christopher Peacock @securepeacock, SCYTHE @scythe_io date: 2022-04-27 modified: 2023-08-23 tags: - attack.stealth - attack.t1218.011 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: .scr filter: TargetFilename|contains: - :\$WINDOWS.~BT\NewOS\ - :\Windows\System32\ - :\Windows\SysWOW64\ - :\Windows\WinSxS\ - :\WUDownloadCache\ condition: selection and not filter falsepositives: - The installation of new screen savers by third party software level: medium
Near-miss passage: Sigma rule: Detects any deletion of entries in ".*\shell\open\command" registry keys. These registry keys might have been used for C. Logsource: windows / registry_delete. Rule: title: Removal of Potential COM Hijacking Registry Keys id: 96f697b0-b499-4e5d-9908-a67bec11cdb6 status: test description: 'Detects any deletion of entries in ".*\shell\open\command" registry keys. These registry keys might have been used for COM hijacking activities by a threat actor or an attacker and the deletion could indicate steps to remove its tracks. ' references: - https://github.com/OTRF/detection-hackathon-apt29/issues/7 - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.C.1_22A46621-7A92-48C1-81BF-B3937EB4FDC3.md - https://learn.microsoft.com/en-us/windows/win32/shell/launch - https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand - https://learn.microsoft.com/en-us/windows/win32/shell/shell-and-managed-code author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-05-02 modified: 2025-10-07 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_delete detection: selection: TargetObject|endswith: \shell\open\command filter_main_explorer: Image|endswith: C:\Windows\explorer.exe filter_main_svchost: Image: C:\Windows\system32\svchost.exe filter_main_msiexec: Image: - C:\Windows\System32\msiexec.exe - C:\Windows\SysWOW64\msiexec.exe filter_main_generic_prorams: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ filter_main_openwith: Image: C:\Windows\System32\OpenWith.exe filter_optional_dropbox: Image|endswith: \Dropbox.exe TargetObject|contains: \Dropbox. filter_optional_wireshark: Image|endswith: \AppData\Local\Temp\Wireshark_uninstaller.exe TargetObject|contains: \wireshark-capture-file\ filter_optional_peazip: Image|contains: peazip TargetObject|contains: \PeaZip. filter_optional_everything: Image|endswith: \Everything.exe TargetObject|contains: \Everything. filter_optional_uninstallers: Image|startswith: C:\Windows\Installer\MSI filter_optional_java: Image|startswith: C:\Program Files (x86)\Java\ Image|endswith: \installer.exe TargetObject|contains: \Classes\WOW6432Node\CLSID\{4299124F-F2C3-41b4-9C73-9236B2AD0E8F} filter_optional_edgeupdate: Image|contains: \Microsoft\EdgeUpdate\Install filter_optional_avira: Image: - C:\Program Files (x86)\Avira\Antivirus\ - C:\Program Files\Avira\Antivirus\ TargetObject|endswith: - \CLSID\{305CA226-D286-468e-B848-2B2E8E697B74}\Shell\Open\Command - \AntiVir.Keyfile\shell\open\command filter_optiona