ATT&CK technique
View on MITRE ATT&CK →
T1546.002
Screensaver
Privilege EscalationPersistence
8 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Unexpected Child Process of macOS Screensaver Engine | production | 2026-09-18 |
| elastic | Uncommon Registry Persistence Change | production | 2026-09-18 |
| elastic | Screensaver Plist File Modified by Unexpected Process | production | 2026-09-18 |
| splunk | Screensaver Event Trigger Execution | production | 2026-05-13 |
| sigma | Suspicious Screensaver Binary File Creation | test | 2022-11-08 |
| sigma | Writing Local Admin Share | test | 2022-08-13 |
| sigma | Suspicious ScreenSave Change by Reg.exe | test | 2022-06-02 |
| sigma | Path To Screensaver Binary Modified | test | 2021-11-27 |