Loading story…
Windows screensaver settings can be abused to achieve persistence by modifying per-user registry keys under HKCU\Control Panel\Desktop, causing a payload to launch after a period of user inactivity. The technique relies on changing values such as ScreenSaveActive, ScreenSaveTimeOut, and SCRNSAVE.EXE so the operating system starts an attacker-controlled executable when the screensaver is triggered, aligning with MITRE ATT&CK sub-technique T1546.002: Event Triggered Execution: Screensaver.
A public technical walkthrough demonstrated the method with C++ and registry-based configuration changes, while noting operational constraints: it depends on screensavers being enabled and may stop once the user resumes activity. Despite those limitations, the approach remains useful for execution during idle periods and has been associated with real-world malware activity, including reporting that Gazer and Turla have used screensaver-based persistence.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
A technical walkthrough showed how to abuse Windows screensaver settings under HKCU\Control Panel\Desktop to launch a payload after user inactivity, including C++, reg.exe, and PowerShell examples. The demonstration configured ScreenSaveTimeOut to 10 seconds and SCRNSAVE.EXE to run a sample payload.
MITRE ATT&CK published the Enterprise sub-technique 'Event Triggered Execution: Screensaver' as T1546.002, documenting screensaver-based execution behavior.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
cocomelonc.github.io
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers can maintain persistence on Windows by abusing **Winlogon** autostart mechanisms, including modification of registry values such as `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell` and `Userinit`, as well as use of the **Winlogon Helper DLL** technique tracked by MITRE ATT&CK as `T1547.004`. By altering these settings, a malicious executable or DLL can be launched automatically during user logon, giving malware a reliable way to survive reboots and regain execution. Public technical material showed a C++ proof of concept that rewrites Winlogon registry keys to start a test payload at logon and noted that older Windows versions may also expose persistence through the `Winlogon\Notify` key. The technique requires elevated privileges, but it has been associated with real-world malware activity, including **Turla**, **Gazer**, and **Bazaar**. Defenders are advised to restrict local administrator access and monitor Winlogon-related autorun entries for unauthorized changes, including with tools such as **Sysinternals Autoruns**.
Aug 15, 2026
A series of public proof-of-concept posts detailed how attackers can establish persistence on Windows by abusing multiple native mechanisms, including `AppInit_DLLs`, COM hijacking, Windows services, logon scripts, file-association changes, uninstall handlers, Event Viewer help links, shell `CLSID` command handlers, and Accessibility Features such as Sticky Keys. The demonstrations showed malware-like code modifying keys under `HKLM` and `HKCU` to force execution at boot, logon, application launch, or user interaction, with several techniques requiring administrator privileges while others worked in the current user context. The examples included replacing `.txt` open commands, setting `HKCU\Environment\UserInitMprLogonScript`, creating malicious `InprocServer32` registrations for COM objects, altering `UninstallString` values for installed software, redirecting Event Viewer online help to a local executable, and using either Image File Execution Options or symbolic links to hijack `sethc.exe`. The posts also tied several methods to known threat activity, citing groups and malware such as **APT28**, **APT39**, **Turla**, **Kimsuky**, **APT3**, **APT29**, **APT32**, **APT38**, **APT41**, Ramsay, Attor, Zebrocy, Mosquito, and SILENTTRINITY as examples of similar persistence tradecraft seen in the wild.
Aug 14, 2026
Security researchers described a Windows persistence technique that abuses **Mandatory User Profiles** by planting a modified `NTUSER.MAN` registry hive in a user profile directory, causing attacker-controlled settings to load into `HKEY_CURRENT_USER` at logon. Because the hive is prepared offline and then consumed by the normal profile-loading process, the method can evade security products that primarily monitor registry API activity such as `RegCreateKey` and `RegSetValue`. The approach is particularly relevant to kiosks, shared workstations, and other environments where mandatory profiles may already be in use. The reporting highlighted proof-of-concept tooling including **Praetorian Swarmer** and **HiveSwarming**, which can transform exported `HKCU` data into an `NTUSER.MAN` hive and add startup persistence such as a **Run** key. Defenders were advised to monitor creation of `NTUSER.MAN` files in user profile paths, correlate those events with **Microsoft-Windows-User Profile Service Operational** events `5` and `67`, and watch for suspicious `Offreg.dll` loads. Researchers characterized the technique as uncommon but stealthy, expanding attention on Windows registry attack surface and profile-handling mechanisms as a path for persistence.
Aug 14, 2026