You notice rundll32.exe being used with desk.cpl,InstallScreenSaver on a Windows endpoint. Investigate your process creation logs to find which .scr file was loaded by this unusual invocation.

DeviceProcessEvents
| where FileName == "rundll32.exe"
| where ProcessCommandLine contains "desk.cpl,InstallScreenSaver"
| extend ScreenSaverFile = extract(@',InstallScreenSaver (.*\.scr)', 1, ProcessCommandLine)
| project Timestamp, DeviceName, ProcessCommandLine, ScreenSaverFile

DeviceProcessEvents
| where FileName =~ "rundll32.exe"
| where ProcessCommandLine has "desk.cpl,InstallScreenSaver" and ProcessCommandLine contains ".scr"
| extend ScreenSaverPath = extract(@"([A-Za-z]:\\[^ ]+?\.scr)", 1, ProcessCommandLine)
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, ScreenSaverPath
| order by TimeGenerated desc

// This query targets rundll32.exe invocations of desk.cpl for InstallScreenSaver
DeviceProcessEvents
| where InitiatingProcessCommandLine has "rundll32.exe" and InitiatingProcessCommandLine has ",InstallScreenSaver"
| where FileName =~ "rundll32.exe" and ProcessCommandLine has ",InstallScreenSaver"
| project TimeGenerated, DeviceName, ProcessCommandLine, InitiatingProcessCommandLine, FileName, ProcessCreationTime, AccountName, AccountDomain

DeviceProcessEvents
| where ProcessCommandLine has "desk.cpl,InstallScreenSaver" and FileName =~ "rundll32.exe"
| extend LoadedScrFile = extract(@"\b([\w\.-]+\.scr)\b", 1, ProcessCommandLine)
| project DeviceName, ProcessCreationTime, ProcessCommandLine, LoadedScrFile
| where isnotempty(LoadedScrFile)
| order by ProcessCreationTime desc

DeviceProcessEvents
| where FileName has "rundll32.exe"
| where ProcessCommandLine contains "desk.cpl,InstallScreenSaver"
| project ProcessId, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCreationTime
| extend loadedScrFile = extract(@"(\w+\.scr)", 1, ProcessCommandLine)
| where isnotempty(loadedScrFile)

DeviceProcessEvents
| where InitiatingProcessCommandLine contains "desk.cpl,InstallScreenSaver"
| where ProcessCommandLine contains ".scr"
| project FileName, FolderPath, ProcessCommandLine, InitiatingProcessCommandLine, TimeGenerated, DeviceName

DeviceProcessEvents
| where ActionType == "ProcessCreated"
| where FileName =~ "rundll32.exe"
| where ProcessCommandLine has "InstallScreenSaver" and ProcessCommandLine has "desk.cpl"
// Try to capture a quoted .scr argument first, then fall back to unquoted
| extend ScreenSaverFile = coalesce(
    extract(@'(?i)"([^"]+\.scr)"', 1, ProcessCommandLine),
    extract(@'(?i)([^\s,]+\.scr)', 1, ProcessCommandLine)
  )
| where isnotempty(ScreenSaverFile)
| project TimeGenerated, DeviceName, AccountDomain, AccountName, FileName, FolderPath, ProcessCommandLine, ScreenSaverFile,
          InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, InitiatingProcessParentId
| order by TimeGenerated desc

// Find rundll32.exe invocations that call desk.cpl,InstallScreenSaver and show which .scr was used or loaded
let rundll = DeviceProcessEvents
| where FileName =~ "rundll32.exe"
| where ProcessCommandLine has "desk.cpl" and ProcessCommandLine has "InstallScreenSaver"
// Try to extract a full-path .scr from the command line (case-insensitive)
| extend ScrFromCmd = extract(@"(?i)([a-zA-Z]:\\[^\"" ]+?\.scr)", 1, ProcessCommandLine)
// Fallback: extract any bare name.scr if full path wasn't present
| extend ScrFromCmd = iff(isempty(ScrFromCmd), extract(@"(?i)([^\\/\s]+?\.scr)", 1, ProcessCommandLine), ScrFromCmd)
| extend InitiatingProcessIdProc = ProcessId
| project TimeGenerated, DeviceName, ProcessId, InitiatingProcessIdProc, ProcessCreationTime, AccountName, ProcessCommandLine, ScrFromCmd;

let imageLoads = DeviceImageLoadEvents
| where FileName endswith ".scr"
| project TimeGeneratedImage = TimeGenerated, DeviceName, LoadedFileName = FileName, FolderPath, InitiatingProcessId, SHA256, MD5;

let fileEvents = DeviceFileEvents
| where FileName endswith ".scr"
| project TimeGeneratedFile = TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessId, FileOriginUrl, FileOriginIP, SHA256;

rundll
// join image loads where the rundll process (ProcessId) is the initiator of the image load
| join kind=leftouter (imageLoads) on $left.DeviceName == $right.DeviceName and $left.InitiatingProcessIdProc == $right.InitiatingProcessId
// also join any file events for .scr files associated with the same rundll process
| join kind=leftouter (fileEvents) on $left.DeviceName == $right.DeviceName and $left.InitiatingProcessIdProc == $right.InitiatingProcessId
| project
    DetectionTime = TimeGenerated,
    DeviceName,
    ProcessId,
    ProcessCreationTime,
    AccountName,
    ProcessCommandLine,
    ScrFromCmd,
    LoadedFileName,
    FolderPath,
    FileName, // from DeviceFileEvents (may be null)
    SHA256 = coalesce(SHA256, SHA2561 = SHA256),
    MD5,
    TimeGeneratedImage,
    TimeGeneratedFile
| order by DetectionTime desc

// Notes: If your portal sets the time range externally, you don't need to add a TimeGenerated filter. Otherwise add e.g. | where TimeGenerated >= ago(7d) to limit the window.

DeviceProcessEvents
| where FileName == 'rundll32.exe'
| where ProcessCommandLine contains 'desk.cpl' and ProcessCommandLine contains 'InstallScreenSaver'
| extend ScrFile = extract(@'(?i)rundll32\.exe\s+desk\.cpl,InstallScreenSaver\s+([^\s]+\.scr)', 1, ProcessCommandLine)
| project TimeGenerated, DeviceName, ProcessCommandLine, ScrFile
| order by TimeGenerated desc

DeviceProcessEvents
| where FileName =~ "rundll32.exe"
| where ProcessCommandLine has "desk.cpl,InstallScreenSaver"
| extend LoadedScr = extract(@"desk\.cpl,InstallScreenSaver\s+([^\s]+\.scr)", 1, ProcessCommandLine)
| where isnotempty(LoadedScr)
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessAccountName, ProcessCommandLine, LoadedScr
| order by TimeGenerated desc

DeviceProcessEvents
| where FileName == "rundll32.exe"
| where ProcessCommandLine has_cs "desk.cpl,InstallScreenSaver"
| extend LoadedScrFile = extract(@"desk\.cpl,InstallScreenSaver\s+([^\s]+\.scr)", 1, ProcessCommandLine)
| project TimeGenerated, DeviceName, AccountDomain, AccountName, ProcessCommandLine, LoadedScrFile
| order by TimeGenerated desc

// -----------------------------------------------
// 1. Rundll32.exe processes that invoke InstallScreenSaver
// -----------------------------------------------
let RundllInstallSS = DeviceProcessEvents
| where FileName =~ "rundll32.exe"
| where ProcessCommandLine has_cs "desk.cpl,InstallScreenSaver"
| extend ScreenSaverPath = extract(@'[A-Za-z]:\\[^\s]+\.scr', 0, ProcessCommandLine)
| project TimeGenerated,
          DeviceId,
          DeviceName,
          AccountName,
          ScreenSaverPath,
          ProcessCommandLine,
          ProcessId,
          SHA256;

// -----------------------------------------------
// 2. .scr images actually loaded by those rundll32.exe instances
// -----------------------------------------------
let ImageLoadedSS = DeviceImageLoadEvents
| where InitiatingProcessFileName =~ "rundll32.exe"
| where InitiatingProcessCommandLine has_cs "desk.cpl,InstallScreenSaver"
| where FileName endswith_cs ".scr"
| extend ScreenSaverPath = iff(isnotempty(FolderPath), strcat(FolderPath, "\\", FileName), FileName)
| project TimeGenerated,
          DeviceId,
          DeviceName,
          AccountName = InitiatingProcessAccountName,
          ScreenSaverPath,
          ProcessCommandLine = InitiatingProcessCommandLine,
          InitiatingProcessId,
          SHA256;

// -----------------------------------------------
// 3. Combine, de-duplicate and summarise
// -----------------------------------------------
RundllInstallSS
| union ImageLoadedSS
| summarize FirstSeen = min(TimeGenerated),
            LastSeen  = max(TimeGenerated),
            Devices   = make_set(DeviceName),
            Accounts  = make_set(AccountName),
            ExampleCmdLines = make_set(ProcessCommandLine, 3)
            by ScreenSaverPath
| order by LastSeen desc