deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Obfuscated PowerShell MSI Install via WindowsInstaller COM
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Meroujan Antonyan (vx3r)
Date: 2025-05-27
ATT&CK techniques: T1027.010, T1218.007, T1059.001
Log source: windows/process_creation

Description:
Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`).
The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting
malformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection
by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with
hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell_ise.exe",
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell_ISE.EXE",
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "-ComObject",
      "InstallProduct(",
      ".Insert(",
      "UILevel"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/
  - https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/
  - https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457
Sigma Detection Rule: Potential RDP Session Hijacking Activity
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @juju4
Date: 2022-12-27
Log source: windows/process_creation

Description:
Detects potential RDP Session Hijacking activity on Windows systems

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\tscon.exe"
    },
    {
      "OriginalFileName": "tscon.exe"
    }
  ],
  "selection_integrity": {
    "IntegrityLevel": [
      "System",
      "S-1-16-16384"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/Moti_B/status/[PII_REDACTED]77659651
Sigma Detection Rule: Uncommon Child Process Of BgInfo.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community
Date: 2019-10-26
ATT&CK techniques: T1059.005, T1218, T1202
Log source: windows/process_creation

Description:
Detects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript

Detection logic:
{
  "selection": {
    "ParentImage|endswith": [
      "\\bginfo.exe",
      "\\bginfo64.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Bginfo/
  - https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/
Sigma Detection Rule: Renamed Schtasks Execution
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-27
ATT&CK techniques: T1036.003, T1053.005
Log source: windows/process_creation

Description:
Detects the execution of renamed schtasks.exe binary, which is a legitimate Windows utility used for scheduling tasks.
One of the very common persistence techniques is schedule malicious tasks using schtasks.exe.
Since, it is heavily abused, it is also heavily monitored by security products. To evade detection, threat actors may rename the schtasks.exe binary to schedule their malicious tasks.


Detection logic:
{
  "selection_cmd_operation": {
    "CommandLine|contains|windash": [
      " /create ",
      " /delete ",
      " /query ",
      " /change ",
      " /run ",
      " /end "
    ]
  },
  "selection_cmd_flags": {
    "CommandLine|contains|windash": [
      " /tn ",
      " /tr ",
      " /sc ",
      " /st ",
      " /ru ",
      " /fo "
    ]
  },
  "selection_pe": {
    "OriginalFileName": "schtasks.exe"
  },
  "filter_main_cmd": {
    "CommandLine|contains": "schtasks"
  },
  "filter_main_img": {
    "Image|endswith": "\\schtasks.exe"
  },
  "condition": "(all of selection_cmd_* and not filter_main_cmd) or (selection_pe and not filter_main_img)"
}

References:
  - https://x.com/JangPr0/status/[PII_REDACTED]26065833
  - https://ss64.com/nt/schtasks.html
Sigma Detection Rule: Windows Binary Executed From WSL
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-14
ATT&CK techniques: T1202
Log source: windows/process_creation

Description:
Detects the execution of Windows binaries from within a WSL instance.
This could be used to masquerade parent-child relationships


Detection logic:
{
  "selection": {
    "Image|re": "[a-zA-Z]:\\\\",
    "CurrentDirectory|contains": "\\\\\\\\wsl.localhost"
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: Add Potential Suspicious New Download Source To Winget
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-17
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects usage of winget to add new potentially suspicious download sources

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\winget.exe"
    },
    {
      "OriginalFileName": "winget.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "source ",
      "add "
    ]
  },
  "selection_source_direct_ip": {
    "CommandLine|re": "://\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}"
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/windows/package-manager/winget/source
  - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
Sigma Detection Rule: HackTool - Pypykatz Credentials Dumping Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-01-05
ATT&CK techniques: T1003.002
Log source: windows/process_creation

Description:
Detects the usage of "pypykatz" to obtain stored credentials. Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database through Windows registry where the SAM database is stored

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\pypykatz.exe",
      "\\python.exe"
    ],
    "CommandLine|contains|all": [
      "live",
      "registry"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/skelsec/pypykatz
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-2---registry-parse-with-pypykatz
Sigma Detection Rule: Directory Removal Via Rmdir
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-01-15
ATT&CK techniques: T1070.004
Log source: windows/process_creation

Description:
Detects execution of the builtin "rmdir" command in order to delete directories.
Adversaries may delete files left behind by the actions of their intrusion activity.
Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how.
Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\cmd.exe"
    },
    {
      "OriginalFileName": "Cmd.Exe"
    }
  ],
  "selection_rmdir": {
    "CommandLine|contains": "rmdir"
  },
  "selection_flags": {
    "CommandLine|contains": [
      "/s",
      "/q"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/erase
Sigma Detection Rule: OpenWith.exe Executes Specified Binary
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Beyu Denis, oscd.community (rule), @harr0ey (idea)
Date: 2019-10-12
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
The OpenWith.exe executes other binary

Detection logic:
{
  "selection": {
    "Image|endswith": "\\OpenWith.exe",
    "CommandLine|contains": "/c"
  },
  "condition": "selection"
}

References:
  - https://github.com/LOLBAS-Project/LOLBAS/blob/4db780e0f0b2e2bb8cb1fa13e09196da9b9f1834/yml/LOLUtilz/OSBinaries/Openwith.yml
  - https://twitter.com/harr0ey/status/[PII_REDACTED]84021504
Sigma Detection Rule: Suspicious Double Extension File Execution
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems)
Date: 2019-06-26
ATT&CK techniques: T1566.001
Log source: windows/process_creation

Description:
Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spear phishing campaigns

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "      .exe",
      "______.exe",
      ".doc.exe",
      ".doc.js",
      ".docx.exe",
      ".docx.js",
      ".gif.exe",
      ".jpeg.exe",
      ".jpg.exe",
      ".mkv.exe",
      ".mov.exe",
      ".mp3.exe",
      ".mp4.exe",
      ".pdf.exe",
      ".pdf.js",
      ".png.exe",
      ".ppt.exe",
      ".ppt.js",
      ".pptx.exe",
      ".pptx.js",
      ".rtf.exe",
      ".rtf.js",
      ".svg.exe",
      ".txt.exe",
      ".txt.js",
      ".xls.exe",
      ".xls.js",
      ".xlsx.exe",
      ".xlsx.js",
      "\u2800\u2800\u2800\u2800\u2800\u2800.exe"
    ],
    "CommandLine|contains": [
      "      .exe",
      "______.exe",
      ".doc.exe",
      ".doc.js",
      ".docx.exe",
      ".docx.js",
      ".gif.exe",
      ".jpeg.exe",
      ".jpg.exe",
      ".mkv.exe",
      ".mov.exe",
      ".mp3.exe",
      ".mp4.exe",
      ".pdf.exe",
      ".pdf.js",
      ".png.exe",
      ".ppt.exe",
      ".ppt.js",
      ".pptx.exe",
      ".pptx.js",
      ".rtf.exe",
      ".rtf.js",
      ".svg.exe",
      ".txt.exe",
      ".txt.js",
      ".xls.exe",
      ".xls.js",
      ".xlsx.exe",
      ".xlsx.js",
      "\u2800\u2800\u2800\u2800\u2800\u2800.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://blu3-team.blogspot.com/2019/06/misleading-extensions-xlsexe-docexe.html
  - https://twitter.com/blackorbird/status/[PII_REDACTED]61825792
  - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
Sigma Detection Rule: Remote PowerShell Session Host Process (WinRM)
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-09-12
ATT&CK techniques: T1059.001, T1021.006
Log source: windows/process_creation

Description:
Detects remote PowerShell sections by monitoring for wsmprovhost (WinRM host process) as a parent or child process (sign of an active PowerShell remote session).

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\wsmprovhost.exe"
    },
    {
      "ParentImage|endswith": "\\wsmprovhost.exe"
    }
  ],
  "condition": "selection"
}

References:
  - https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html
Sigma Detection Rule: Abusing Print Executable
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative
Date: 2020-10-05
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Attackers can use print.exe for remote file copy

Detection logic:
{
  "selection": {
    "Image|endswith": "\\print.exe",
    "CommandLine|startswith": "print",
    "CommandLine|contains|all": [
      "/D",
      ".exe"
    ]
  },
  "filter_print": {
    "CommandLine|contains": "print.exe"
  },
  "condition": "selection and not filter_print"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Print/
  - https://twitter.com/Oddvarmoe/status/[PII_REDACTED]76541440
Sigma Detection Rule: Uncommon Link.EXE Parent Process
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-22
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects an uncommon parent process of "LINK.EXE".
Link.EXE in Microsoft incremental linker. Its a utility usually bundled with Visual Studio installation.
Multiple utilities often found in the same folder (editbin.exe, dumpbin.exe, lib.exe, etc) have a hardcode call to the "LINK.EXE" binary without checking its validity.
This would allow an attacker to sideload any binary with the name "link.exe" if one of the aforementioned tools get executed from a different location.
By filtering the known locations of such utilities we can spot uncommon parent process of LINK.EXE that might be suspicious or malicious.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\link.exe",
    "CommandLine|contains": "LINK /"
  },
  "filter_main_visual_studio": {
    "ParentImage|startswith": [
      "C:\\Program Files\\Microsoft Visual Studio\\",
      "C:\\Program Files (x86)\\Microsoft Visual Studio\\"
    ],
    "ParentImage|contains": [
      "\\VC\\bin\\",
      "\\VC\\Tools\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://twitter.com/0gtweet/status/[PII_REDACTED]35729152
Sigma Detection Rule: Potential Register_App.Vbs LOLScript Abuse
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-11-05
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects potential abuse of the "register_app.vbs" script that is part of the Windows SDK. The script offers the capability to register new VSS/VDS Provider as a COM+ application. Attackers can use this to install malicious DLLs for persistence and execution.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\cscript.exe",
        "\\wscript.exe"
      ]
    },
    {
      "OriginalFileName": [
        "cscript.exe",
        "wscript.exe"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains": ".vbs -register "
  },
  "condition": "all of selection*"
}

References:
  - https://twitter.com/sblmsrsn/status/[PII_REDACTED]83160325?s=20
  - https://github.com/microsoft/Windows-classic-samples/blob/7cbd99ac1d2b4a0beffbaba29ea63d024ceff700/Samples/Win7Samples/winbase/vss/vsssampleprovider/register_app.vbs
Sigma Detection Rule: Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell
Repository: SigmaHQ/sigma
Severity: medium
Status: stable
Author: Markus Neis @Karneades
Date: 2019-04-03
ATT&CK techniques: T1047, T1059.001
Log source: windows/process_creation

Description:
Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\WmiPrvSE.exe"
  },
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://any.run/report/68bc255f9b0db6a0d30a8f2dadfbee3256acfe12497bf93943bc1eab0735e45e/a2385d6f-34f7-403c-90d3-b1f9d2a90a5e
Sigma Detection Rule: Suspicious Usage Of ShellExec_RunDLL
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-01
Log source: windows/process_creation

Description:
Detects suspicious usage of the ShellExec_RunDLL function to launch other commands as seen in the the raspberry-robin attack

Detection logic:
{
  "selection_openasrundll": {
    "CommandLine|contains": "ShellExec_RunDLL"
  },
  "selection_suspcli": {
    "CommandLine|contains": [
      "\\Desktop\\",
      "\\Temp\\",
      "\\Users\\Public\\",
      "comspec",
      "iex",
      "Invoke-",
      "msiexec",
      "odbcconf",
      "regsvr32"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://redcanary.com/blog/raspberry-robin/
  - https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: PowerShell Execution With Potential Decryption Capabilities
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-30
Log source: windows/process_creation

Description:
Detects PowerShell commands that decrypt an ".LNK" "file to drop the next stage of the malware.

Detection logic:
{
  "selection_img": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "OriginalFileName": [
      "PowerShell.EXE",
      "pwsh.dll"
    ]
  },
  "selection_cli_dir": {
    "CommandLine|contains": [
      "Get-ChildItem ",
      "dir ",
      "gci ",
      "ls "
    ]
  },
  "selection_cli_gc": {
    "CommandLine|contains": [
      "Get-Content ",
      "gc ",
      "cat ",
      "type ",
      "ReadAllBytes"
    ]
  },
  "selection_cli_specific": [
    {
      "CommandLine|contains|all": [
        " ^| ",
        "\\*.lnk",
        "-Recurse",
        "-Skip "
      ]
    },
    {
      "CommandLine|contains|all": [
        " -ExpandProperty ",
        "\\*.lnk",
        "WriteAllBytes",
        " .length "
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://research.checkpoint.com/2023/chinese-threat-actors-targeting-europe-in-smugx-campaign/
Sigma Detection Rule: System Language Discovery via Reg.Exe
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
Date: 2026-01-09
ATT&CK techniques: T1614.001
Log source: windows/process_creation

Description:
Detects the usage of Reg.Exe to query system language settings.
Attackers may discover the system language to determine the geographic location of victims, customize payloads for specific regions,
or avoid targeting certain locales to evade detection.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\reg.exe"
    },
    {
      "OriginalFileName": "reg.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "query",
      "Control\\Nls\\Language"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://scythe.io/threat-thursday/threatthursday-darkside-ransomware
Sigma Detection Rule: Conhost Spawned By Uncommon Parent Process
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Tim Rauch, Elastic (idea)
Date: 2022-09-28
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\conhost.exe",
    "ParentImage|endswith": [
      "\\explorer.exe",
      "\\lsass.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\services.exe",
      "\\smss.exe",
      "\\spoolsv.exe",
      "\\svchost.exe",
      "\\userinit.exe",
      "\\wininit.exe",
      "\\winlogon.exe"
    ]
  },
  "filter_main_svchost": {
    "ParentCommandLine|contains": [
      "-k apphost -s AppHostSvc",
      "-k imgsvc",
      "-k localService -p -s RemoteRegistry",
      "-k LocalSystemNetworkRestricted -p -s NgcSvc",
      "-k NetSvcs -p -s NcaSvc",
      "-k netsvcs -p -s NetSetupSvc",
      "-k netsvcs -p -s wlidsvc",
      "-k NetworkService -p -s DoSvc",
      "-k wsappx -p -s AppXSvc",
      "-k wsappx -p -s ClipSVC",
      "-k wusvcs -p -s WaaSMedicSvc"
    ]
  },
  "filter_optional_dropbox": {
    "ParentCommandLine|contains": [
      "C:\\Program Files (x86)\\Dropbox\\Client\\",
      "C:\\Program Files\\Dropbox\\Client\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://www.elastic.co/guide/en/security/current/conhost-spawned-by-suspicious-parent-process.html
Sigma Detection Rule: File Encryption/Decryption Via Gpg4win From Suspicious Locations
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
Date: 2022-11-30
Log source: windows/process_creation

Description:
Detects usage of Gpg4win to encrypt/decrypt files located in potentially suspicious locations.

Detection logic:
{
  "selection_metadata": [
    {
      "Image|endswith": [
        "\\gpg.exe",
        "\\gpg2.exe"
      ]
    },
    {
      "Product": "GNU Privacy Guard (GnuPG)"
    },
    {
      "Description": "GnuPG\u2019s OpenPGP tool"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "-passphrase"
  },
  "selection_paths": {
    "CommandLine|contains": [
      ":\\PerfLogs\\",
      ":\\Temp\\",
      ":\\Users\\Public\\",
      ":\\Windows\\Temp\\",
      "\\AppData\\Local\\Temp\\",
      "\\AppData\\Roaming\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
  - https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/
Sigma Detection Rule: Suspicious ScreenSave Change by Reg.exe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-08-19
ATT&CK techniques: T1546.002
Log source: windows/process_creation

Description:
Adversaries may establish persistence by executing malicious content triggered by user inactivity.
Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension


Detection logic:
{
  "selection_reg": {
    "Image|endswith": "\\reg.exe",
    "CommandLine|contains": [
      "HKEY_CURRENT_USER\\Control Panel\\Desktop",
      "HKCU\\Control Panel\\Desktop"
    ]
  },
  "selection_option_1": {
    "CommandLine|contains|all": [
      "/v ScreenSaveActive",
      "/t REG_SZ",
      "/d 1",
      "/f"
    ]
  },
  "selection_option_2": {
    "CommandLine|contains|all": [
      "/v ScreenSaveTimeout",
      "/t REG_SZ",
      "/d ",
      "/f"
    ]
  },
  "selection_option_3": {
    "CommandLine|contains|all": [
      "/v ScreenSaverIsSecure",
      "/t REG_SZ",
      "/d 0",
      "/f"
    ]
  },
  "selection_option_4": {
    "CommandLine|contains|all": [
      "/v SCRNSAVE.EXE",
      "/t REG_SZ",
      "/d ",
      ".scr",
      "/f"
    ]
  },
  "condition": "selection_reg and 1 of selection_option_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.002/T1546.002.md
  - https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf