T1546.002

Description

Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

• <code>ScreenSaveActive</code> - set to '1' to enable the screensaver
• <code>ScreenSaverIsSecure</code> - set to '0' to not require a password to unlock
• <code>ScreenSaveTimeout</code> - sets user inactivity timeout before screensaver is executed Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity.