Suspicious SCR File Creation Outside System Folders
This rule detects the creation of screensaver files (.scr) in locations outside of standard Windows system directories. Attackers often leverage .scr files, which are essentially executable files, to deliver and execute malicious payloads. By filtering out common legitimate system paths, the rule aims to identify suspicious instances where an .scr file might be dropped or created by an adversary, potentially as part of a defense evasion or execution technique. The rule's description specifically mentions the use of "rundll32.exe desk.cpl,InstallScreenSaver" as an example of how an attacker might execute such a file.
Sigma
