huntrule

Windows Screen Capture via psr.exe (Problem Steps Recorder) Execution

Flags psr.exe launched with /start or -start, indicating potential user screen and click recording.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Beyu Denis, oscd.community (SigmaHQ), DRL 1.1
Published
2019-10-12
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Collection

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies execution of the Windows Problem Steps Recorder (psr.exe) when launched with start-related command-line arguments. Attackers can use this built-in utility to capture user activity such as screen content and interactions, which may support discovery and credential or data harvesting. The detection relies on process creation telemetry, matching psr.exe execution and specific /start or -start parameters in the command line.

Reporting behind it

Related detections9 linkedT1113 — drag to rearrange
Suspicious Keylog and Screenshot Files in windows-cache Directory (OtterCookie)
Suspicious RDP Shadow Session Started - Native (via rdp)
Malicious RDP Shadow Session Configuration Enabled - Registry (via registry_event)
Suspicious GoGRPC Screen Capture Log File Creation (via file_event)
Suspicious Screen Capture via PowerShell Graphics API (via process_creation)
Malicious RDP Shadow Session Started - Command (via process_creation)
Windows Registry: EnablePeriodicBackup value set for periodic system hive backups
Windows Recall Enabled by Deleting DisableAIDataAnalysis Registry Value
Windows Recall Enabled by Registry: DisableAIDataAnalysis Set to 0 (Windows)
Windows Screen Capture via psr.exe (Problem Steps Recorder) Execution
Pivot detection · T1113 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.