Usecase: Launch any executable payload, as long as it uses the .scr extension.
Privileges required: User
OS: Windows 10, Windows 11
MITRE ATT&CK®: T1218.011
Launch a remote executable with a .scr extension, located on an SMB share, by calling the InstallScreenSaver function.
Usecase: Launch any executable payload, as long as it uses the .scr extension.
Privileges required: User
OS: Windows 10, Windows 11
MITRE ATT&CK®: T1218.011