Windows Screen Capture via psr.exe (Problem Steps Recorder) Execution

title: Windows Screen Capture via psr.exe (Problem Steps Recorder) Execution
id: 20f08909-f9ee-4d4c-aa27-1b7868757860
status: test
description: This rule identifies execution of the Windows Problem Steps Recorder (psr.exe) when launched with start-related command-line arguments. Attackers can use this built-in utility to capture user activity such as screen content and interactions, which may support discovery and credential or data harvesting. The detection relies on process creation telemetry, matching psr.exe execution and specific /start or -start parameters in the command line.
references:
  - https://lolbas-project.github.io/lolbas/Binaries/Psr/
  - https://web.archive.org/web/20200229201156/https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1493861893.pdf
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_psr_capture_screenshots.yml
author: Beyu Denis, oscd.community, Huntrule Team
date: 2019-10-12
modified: 2024-01-04
tags:
  - attack.collection
  - attack.t1113
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \Psr.exe
    CommandLine|contains:
      - /start
      - -start
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 2158f96f-43c2-43cb-952a-ab4580f32382
    type: derived