Event Triggered Execution: Screensaver
- ID
- T1546.002
- Tactics
- TA0003 Persistence, TA0004 Privilege Escalation
- Sub-technique of
- T1546 Event Triggered Execution
- Platforms
- Windows
- Data sources
- Process Creation, Windows Registry Key Modification
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.[2] The Windows screensaver application scrnsave.scr is located in C:\Windows\System32\, and C:\Windows\sysWOW64\ on 64-bit Windows systems, along with screensavers included with base Windows installations.
The following screensaver settings are stored in the Registry (HKCU\Control Panel\Desktop\) and could be manipulated to achieve persistence:
SCRNSAVE.exe- set to malicious PE pathScreenSaveActive- set to '1' to enable the screensaverScreenSaverIsSecure- set to '0' to not require a password to unlockScreenSaveTimeout- sets user inactivity timeout before screensaver is executed
Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity.[3]
Detection
- DET0154 Detect Screensaver-Based Persistence via Registry and Execution Chains
Data components: Process Creation, Windows Registry Key Modification
Mitigations (2)
- M1038 Execution Prevention
Block .scr files from being executed from non-standard locations.
- M1042 Disable or Remove Feature or Program
Use Group Policy to disable screensavers if they are unnecessary.[1]
Software (1)
References
- TechNet Screensaver GP
- Wikipedia Screensaver
- ESET Gazer Aug 2017