T1546.002: Screensaver
Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.[1] The Windows screensaver application scrnsave.scr is located in C:\Windows\System32\, and C:\Windows\sysWOW64\ on 64-bit Windows systems, along with screensavers included with base Windows installations.
The following screensaver settings are stored in the Registry (HKCU\Control Panel\Desktop\) and could be manipulated to achieve persistence:
* SCRNSAVE.exe - set to malicious PE path * ScreenSaveActive - set to '1' to enable the screensaver * ScreenSaverIsSecure - set to '0' to not require a password to unlock * ScreenSaveTimeout - sets user inactivity timeout before screensaver is executed
Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity.[2]
Analyst context for executives and security teams
Screensaver persistence matters because it turns a normal Windows usability feature into a delayed execution point. A malicious .scr/PE path in the current user’s screensaver Registry settings can cause code to run after user inactivity, making the behavior easy to overlook if teams only monitor startup folders, services, or scheduled tasks.
Executive priority
Treat this as a Windows endpoint resilience and audit-evidence issue: can the organization prove that user-level persistence locations are monitored, that unauthorized executables are prevented from running, and that incident responders can quickly review affected user Registry settings? Priority is highest for environments where Windows workstations hold sensitive access, remain logged in for long periods, or have weak application control.
Technical view
This is a Windows sub-technique of Event Triggered Execution for persistence and privilege-escalation tactics. Validate coverage around HKCU\Control Panel\Desktop\ screensaver values, especially SCRNSAVE.exe, ScreenSaveActive, ScreenSaverIsSecure, and ScreenSaveTimeout, and correlate Registry changes with execution of .scr files or PE files from unusual paths. The related ATT&CK detection strategy DET0154 specifically frames detection around screensaver-based persistence via Registry and execution chains. Also account for the revoked predecessor T1180 when mapping older detections or reporting to ATT&CK IDs.
Likely telemetry
- Windows Registry modification events for HKCU\Control Panel\Desktop\ screensaver values
- Process execution telemetry for .scr files and associated PE execution
- File path and hash metadata for configured screensaver executables
- User context, host, and timestamp for Registry changes and subsequent execution
- Endpoint detection or application control logs showing allowed or blocked screensaver execution
Detection direction
- Baseline legitimate screensaver configuration changes and alert on SCRNSAVE.exe values pointing outside expected Windows screensaver locations or approved enterprise paths.
- Correlate ScreenSaveActive/ScreenSaveTimeout changes with later execution of the configured screensaver binary after inactivity.
- Tune for administrative software, endpoint management, or user personalization workflows that may legitimately change screensaver settings.
- Check whether monitoring includes HKCU per-user Registry hives; machine-level monitoring alone can miss this technique.
- Map detections to T1546.002 rather than revoked T1180 for current ATT&CK reporting, while retaining legacy mapping where needed.
Mitigation priorities
- Prioritize execution prevention for unauthorized code, consistent with M1038, using application control or equivalent allowlisting to restrict unapproved .scr/PE execution.
- Disable or remove unnecessary screensaver functionality where business requirements allow, consistent with M1042.
- Harden standard endpoint configuration so password-protected lock behavior is not weakened by user-level changes.
- Include screensaver Registry locations in endpoint hardening reviews, incident response triage, and compliance evidence collection.
Analyst notes and limits
The object includes no official ATT&CK detection text, so detection guidance is derived from the technique description and the supplied DET0154 relationship. The supplied software relationship notes Gazer uses this technique, but this take does not infer current activity, attribution, or exposure.
Coverage depends on local Windows logging, EDR visibility, application control policy, and whether per-user Registry changes are collected. ATT&CK fields support Windows only for this sub-technique; no claims are made for other platforms.
Screensaver
Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.[1] The Windows screensaver application scrnsave.scr is located in C:\Windows\System32\, and C:\Windows\sysWOW64\ on 64-bit Windows systems, along with screensavers included with base Windows installations.
The following screensaver settings are stored in the Registry (HKCU\Control Panel\Desktop\) and could be manipulated to achieve persistence:
* SCRNSAVE.exe - set to malicious PE path * ScreenSaveActive - set to '1' to enable the screensaver * ScreenSaverIsSecure - set to '0' to not require a password to unlock * ScreenSaveTimeout - sets user inactivity timeout before screensaver is executed
Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity.[2]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1546 | Event Triggered Execution | This object subtechnique of Event Triggered Execution. |
| Enterprise | T1180 | Screensaver | Screensaver revoked by this object. |
Groups, software, and campaigns
S0168: Gazer
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.3 | Current bundle | 5e583cfd707f… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Wikipedia Screensaver
Wikipedia. (2017, November 22). Screensaver. Retrieved December 5, 2017.
Open source URL -
[2]
ESET Gazer Aug 2017
ESET. (2017, August). Gazing at Gazer: Turla’s new second stage backdoor. Retrieved September 14, 2017.
Open source URL -
[3]
mitre-attack T1546.002Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.