Screensaver persistence (MITRE ATT&CK T1546.002) is a Windows technique that runs code when the user is inactive. Screensavers are Portable Executable (PE) files with a .scr extension that start after a configurable idle time.
How attackers use it
The stock Windows screensaver application, scrnsave.scr, lives in C:\Windows\System32\ and, on 64-bit Windows, C:\Windows\sysWOW64\, along with the screensavers that ship with Windows.
The settings sit in the registry under HKCU\Control Panel\Desktop\. MITRE lists four that can be manipulated:
SCRNSAVE.exeset to a malicious PE path.ScreenSaveActiveset to 1 to enable the screensaver.ScreenSaverIsSecureset to 0 so no password is needed to unlock.ScreenSaveTimeoutto set the idle time before it runs.
An adversary sets these so malware runs after a stretch of inactivity, which also tends to happen when nobody is watching the screen.
How to detect it
MITRE's strategy joins registry changes to execution:
- Modifications to the HKCU Control Panel Desktop values above.
- Execution of
.scrfiles whose image paths do not match known legitimate screensavers. - Execution that follows a user inactivity timeout.
A screensaver that runs from a user profile or temp directory rather than the Windows folders is a strong signal.
How to reduce the risk
- Block execution from odd places. MITRE advises blocking
.scrfiles from running from non-standard locations. - Remove the feature. Use Group Policy to disable screensavers if you do not need them.
Check your own environment
A read-only check from a Windows command prompt:
reg query "HKCU\Control Panel\Desktop" /v SCRNSAVE.EXE
reg query "HKCU\Control Panel\Desktop" /v ScreenSaverIsSecure
A missing SCRNSAVE.EXE value is normal where screensavers are disabled. A path outside the Windows folders is not.
Quick check
Why is ScreenSaverIsSecure set to 0 a useful clue?
It means no password is needed on unlock. Combined with an odd SCRNSAVE.exe path, it points to tampering rather than a user preference.
