Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user
inactivity and consist of Portable Executable (PE) files with a .scr file extension.[1] The
Windows screensaver application scrnsave.scr is located in C:\Windows\System32\, and C:\Windows\sysWOW64\ on 64-bit Windows systems, along with
screensavers included with base Windows installations.
攻撃者は、ユーザの活動がないことをトリガーに悪意のあるコンテンツを実行することで、永続性を確立することができます。スクリーンセーバーは、ユーザーが活動しない設定された時間の後に実行されるプログラムで、.scrファイル拡張子を持つPortable Executable（PE）ファイルで構成されています[1]。Windowsスクリーンセーバーアプリケーション
scrnsave.scr は、基本のWindowsインストールに含まれるスクリーンセーバーと一緒に、C:\Windows\System32\、64ビットWindowsシステムにはC:\Windows\sysWOW64\に配置されています。
The following screensaver settings are stored in the Registry (HKCU\Control Panel\Desktop\) and could be manipulated to achieve persistence:
SCRNSAVE.exe - set to malicious PE path
ScreenSaveActive - set to '1' to enable the screensaver
ScreenSaverIsSecure - set to '0' to not require a password to unlock
ScreenSaveTimeout - sets user inactivity timeout before screensaver is executed
Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity.[2]
攻撃者は、スクリーンセーバーの設定を利用して、ユーザーが一定時間操作しないとマルウェアが実行されるようすることで、永続性を維持することができます。
| ID | Name | Description |
|---|---|---|
| S0168 | Gazer |
Gazer can establish persistence through the system screensaver by configuring it to execute the malware.[2] |
| ID | Mitigation | Description |
|---|---|---|
| M1042 | Disable or Remove Feature or Program |
Use Group Policy to disable screensavers if they are unnecessary.[3] |
| M1038 | Execution Prevention |
Block .scr files from being executed from non-standard locations. |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0017 | Command | Command Execution |
Monitor executed commands and arguments of .scr files. |
| DS0022 | File | File Creation |
Monitor newly constructed files that may establish persistence by executing malicious content triggered by user inactivity. |
| File Modification |
Monitor for changes made to files that may establish persistence by executing malicious content triggered by user inactivity. |
||
| DS0009 | Process | Process Creation |
Monitor newly executed processes that may establish persistence by executing malicious content triggered by user inactivity. |
| DS0024 | Windows Registry | Windows Registry Key Modification |
Monitor changes to screensaver configuration changes in the Registry that may not correlate with typical user behavior. Tools such as Sysinternals Autoruns can be used to detect changes to the screensaver binary path in the Registry. |