Skip to content

Hide Navigation Hide TOC

Rundll32 InstallScreenSaver Execution (15bd98ea-55f4-4d37-b09a-e7caa0fa2221)

An attacker may execute an application as a SCR File using rundll32.exe desk.cpl,InstallScreenSaver

Cluster A Galaxy A Cluster B Galaxy B Level
Rundll32 - T1218.011 (045d0922-2310-4e60-b5e4-3302302cb3c5) Attack Pattern Rundll32 InstallScreenSaver Execution (15bd98ea-55f4-4d37-b09a-e7caa0fa2221) Sigma-Rules 1
System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4) Attack Pattern Rundll32 - T1218.011 (045d0922-2310-4e60-b5e4-3302302cb3c5) Attack Pattern 2