Rundll32 InstallScreenSaver Execution

Title: Rundll32 InstallScreenSaver Execution
Status: test
Description:An attacker may execute an application as a SCR File using rundll32.exe desk.cpl,InstallScreenSaver
References:
  -https://lolbas-project.github.io/lolbas/Libraries/Desk/
  -https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1218.011/T1218.011.md#atomic-test-13---rundll32-with-deskcpl
Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io, TactiKoolSec
Date: 2022-04-28
modified:2023-02-09
Tags:

• -'attack.stealth'
• -'attack.t1218.011'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\rundll32.exe' OriginalFileName:'RUNDLL32.EXE'   selection_cli:
    CommandLine|contains: 'InstallScreenSaver'
  condition:all of selection_*
Falsepositives:
  -Legitimate installation of a new screensaver
Level: medium