attack.t1546.002

Path To Screensaver Binary Modified

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1546.002 ·

Detects value modification of registry key containing path to binary used as screensaver.

Suspicious ScreenSave Change by Reg.exe

Aug 12, 2024 · attack.privilege-escalation attack.t1546.002 ·

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension

Suspicious Screensaver Binary File Creation

Aug 12, 2024 · attack.persistence attack.t1546.002 ·

Share on:

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension

Writing Local Admin Share

Aug 12, 2024 · attack.lateral-movement attack.t1546.002 ·

Share on:

Aversaries may use to interact with a remote network share using Server Message Block (SMB). This technique is used by post-exploitation frameworks.