Screen Saver Registry Key Set by Rundll32
Detects the creation or modification of a registry key related to screen savers, specifically when `rundll32.exe` is used to set a screen saver executable (`SCRNSAVE.EXE`) to a `.scr` file, while excluding common legitimate system paths. This technique can be used by adversaries to establish persistence or execute malicious code through masqueraded screen saver files.
Sigma
