What MITRE ATT&CK T1546.002: Screensaver (Enterprise Tactic TA0004 - Privilege Escalation / TA0003 - Persistence) requires
MITRE ATT&CK T1546.002 (Screensaver) is an Enterprise Privilege Escalation and Persistence sub-technique of T1546 (Event Triggered Execution). Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension. The Windows screensaver application scrnsave.scr is located in C:\Windows\System32\, and C:\Windows\sysWOW64\ on 64-bit Windows systems, along with screensavers included with base Windows installations. Affected platforms: Windows. MITRE-documented mitigations include M1038 Execution Prevention, M1042 Disable or Remove Feature or Program. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls AC-02, AC-03, AC-06, CM-02, CM-03, CM-06, CM-07, CM-08.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1546/002/
SHA-256 integrity: 382b6e8ff4b86433eafc9eb413c5a88d702f5a99ff643bb9d0e99a0812af7666
Primary Citations — 7 traced to source
- MITRE ATT&CK Technique T1546.002: Screensaver (https://attack.mitre.org/techniques/T1546/002/)
- MITRE ATT&CK Tactic TA0004: Privilege Escalation (https://attack.mitre.org/tactics/TA0004/)
+ 5 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access
- Discovery (free): /api/v1/nodes/mitre-attack-t1546-002-screensaver.json — 6-field metadata
- Vault (full node): /api/v1/vault/nodes/mitre-attack-t1546-002-screensaver.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
- Canonical URL: https://bidda.com/intelligence/mitre-attack-t1546-002-screensaver
- Back to registry: Browse all 10,085 compliance nodes