Question Analysis

DeviceProcessEvents | where FileName == "rundll32.exe" | where ProcessCommandLine contains "desk.cpl,InstallScreenSaver" | extend ScreenSaverFile = extract(@',InstallScreenSaver (.*\.scr)', 1, ProcessCommandLine) | project Timestamp, DeviceName, ProcessCommandLine, ScreenSaverFile

DeviceProcessEvents | where FileName =~ "rundll32.exe" | where ProcessCommandLine has "desk.cpl,InstallScreenSaver" and ProcessCommandLine contains ".scr" | extend ScreenSaverPath = extract(@"([A-Za-z]:\\[^ ]+?\.scr)", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, ScreenSaverPath | order by TimeGenerated desc

// This query targets rundll32.exe invocations of desk.cpl for InstallScreenSaver DeviceProcessEvents | where InitiatingProcessCommandLine has "rundll32.exe" and InitiatingProcessCommandLine has ",InstallScreenSaver" | where FileName =~ "rundll32.exe" and ProcessCommandLine has ",InstallScreenSaver" | project TimeGenerated, DeviceName, ProcessCommandLine, InitiatingProcessCommandLine, FileName, ProcessCreationTime, AccountName, AccountDomain

DeviceProcessEvents | where ProcessCommandLine has "desk.cpl,InstallScreenSaver" and FileName =~ "rundll32.exe" | extend LoadedScrFile = extract(@"\b([\w\.-]+\.scr)\b", 1, ProcessCommandLine) | project DeviceName, ProcessCreationTime, ProcessCommandLine, LoadedScrFile | where isnotempty(LoadedScrFile) | order by ProcessCreationTime desc

DeviceProcessEvents | where FileName has "rundll32.exe" | where ProcessCommandLine contains "desk.cpl,InstallScreenSaver" | project ProcessId, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCreationTime | extend loadedScrFile = extract(@"(\w+\.scr)", 1, ProcessCommandLine) | where isnotempty(loadedScrFile)

DeviceProcessEvents | where InitiatingProcessCommandLine contains "desk.cpl,InstallScreenSaver" | where ProcessCommandLine contains ".scr" | project FileName, FolderPath, ProcessCommandLine, InitiatingProcessCommandLine, TimeGenerated, DeviceName

DeviceProcessEvents | where ActionType == "ProcessCreated" | where FileName =~ "rundll32.exe" | where ProcessCommandLine has "InstallScreenSaver" and ProcessCommandLine has "desk.cpl" // Try to capture a quoted .scr argument first, then fall back to unquoted | extend ScreenSaverFile = coalesce( extract(@'(?i)"([^"]+\.scr)"', 1, ProcessCommandLine), extract(@'(?i)([^\s,]+\.scr)', 1, ProcessCommandLine) ) | where isnotempty(ScreenSaverFile) | project TimeGenerated, DeviceName, AccountDomain, AccountName, FileName, FolderPath, ProcessCommandLine, ScreenSaverFile, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, InitiatingProcessParentId | order by TimeGenerated desc

// Find rundll32.exe invocations that call desk.cpl,InstallScreenSaver and show which .scr was used or loaded let rundll = DeviceProcessEvents | where FileName =~ "rundll32.exe" | where ProcessCommandLine has "desk.cpl" and ProcessCommandLine has "InstallScreenSaver" // Try to extract a full-path .scr from the command line (case-insensitive) | extend ScrFromCmd = extract(@"(?i)([a-zA-Z]:\\[^\"" ]+?\.scr)", 1, ProcessCommandLine) // Fallback: extract any bare name.scr if full path wasn't present | extend ScrFromCmd = iff(isempty(ScrFromCmd), extract(@"(?i)([^\\/\s]+?\.scr)", 1, ProcessCommandLine), ScrFromCmd) | extend InitiatingProcessIdProc = ProcessId | project TimeGenerated, DeviceName, ProcessId, InitiatingProcessIdProc, ProcessCreationTime, AccountName, ProcessCommandLine, ScrFromCmd; let imageLoads = DeviceImageLoadEvents | where FileName endswith ".scr" | project TimeGeneratedImage = TimeGenerated, DeviceName, LoadedFileName = FileName, FolderPath, InitiatingProcessId, SHA256, MD5; let fileEvents = DeviceFileEvents | where FileName endswith ".scr" | project TimeGeneratedFile = TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessId, FileOriginUrl, FileOriginIP, SHA256; rundll // join image loads where the rundll process (ProcessId) is the initiator of the image load | join kind=leftouter (imageLoads) on $left.DeviceName == $right.DeviceName and $left.InitiatingProcessIdProc == $right.InitiatingProcessId // also join any file events for .scr files associated with the same rundll process | join kind=leftouter (fileEvents) on $left.DeviceName == $right.DeviceName and $left.InitiatingProcessIdProc == $right.InitiatingProcessId | project DetectionTime = TimeGenerated, DeviceName, ProcessId, ProcessCreationTime, AccountName, ProcessCommandLine, ScrFromCmd, LoadedFileName, FolderPath, FileName, // from DeviceFileEvents (may be null) SHA256 = coalesce(SHA256, SHA2561 = SHA256), MD5, TimeGeneratedImage, TimeGeneratedFile | order by DetectionTime desc // Notes: If your portal sets the time range externally, you don't need to add a TimeGenerated filter. Otherwise add e.g. | where TimeGenerated >= ago(7d) to limit the window.

DeviceProcessEvents | where FileName == 'rundll32.exe' | where ProcessCommandLine contains 'desk.cpl' and ProcessCommandLine contains 'InstallScreenSaver' | extend ScrFile = extract(@'(?i)rundll32\.exe\s+desk\.cpl,InstallScreenSaver\s+([^\s]+\.scr)', 1, ProcessCommandLine) | project TimeGenerated, DeviceName, ProcessCommandLine, ScrFile | order by TimeGenerated desc

DeviceProcessEvents | where FileName =~ "rundll32.exe" | where ProcessCommandLine has "desk.cpl,InstallScreenSaver" | extend LoadedScr = extract(@"desk\.cpl,InstallScreenSaver\s+([^\s]+\.scr)", 1, ProcessCommandLine) | where isnotempty(LoadedScr) | project TimeGenerated, DeviceName, AccountName, InitiatingProcessAccountName, ProcessCommandLine, LoadedScr | order by TimeGenerated desc

DeviceProcessEvents | where FileName == "rundll32.exe" | where ProcessCommandLine has_cs "desk.cpl,InstallScreenSaver" | extend LoadedScrFile = extract(@"desk\.cpl,InstallScreenSaver\s+([^\s]+\.scr)", 1, ProcessCommandLine) | project TimeGenerated, DeviceName, AccountDomain, AccountName, ProcessCommandLine, LoadedScrFile | order by TimeGenerated desc

// ----------------------------------------------- // 1. Rundll32.exe processes that invoke InstallScreenSaver // ----------------------------------------------- let RundllInstallSS = DeviceProcessEvents | where FileName =~ "rundll32.exe" | where ProcessCommandLine has_cs "desk.cpl,InstallScreenSaver" | extend ScreenSaverPath = extract(@'[A-Za-z]:\\[^\s]+\.scr', 0, ProcessCommandLine) | project TimeGenerated, DeviceId, DeviceName, AccountName, ScreenSaverPath, ProcessCommandLine, ProcessId, SHA256; // ----------------------------------------------- // 2. .scr images actually loaded by those rundll32.exe instances // ----------------------------------------------- let ImageLoadedSS = DeviceImageLoadEvents | where InitiatingProcessFileName =~ "rundll32.exe" | where InitiatingProcessCommandLine has_cs "desk.cpl,InstallScreenSaver" | where FileName endswith_cs ".scr" | extend ScreenSaverPath = iff(isnotempty(FolderPath), strcat(FolderPath, "\\", FileName), FileName) | project TimeGenerated, DeviceId, DeviceName, AccountName = InitiatingProcessAccountName, ScreenSaverPath, ProcessCommandLine = InitiatingProcessCommandLine, InitiatingProcessId, SHA256; // ----------------------------------------------- // 3. Combine, de-duplicate and summarise // ----------------------------------------------- RundllInstallSS | union ImageLoadedSS | summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Devices = make_set(DeviceName), Accounts = make_set(AccountName), ExampleCmdLines = make_set(ProcessCommandLine, 3) by ScreenSaverPath | order by LastSeen desc