Analytics BIOC Medium
✕

Possible collection of screen captures with Windows Problem Steps Recorder

Windows Problem Steps Recorder (psr.exe), can record screen and clicks. Adversaries may abuse psr.exe to create screen captures and collect them afterward.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Collection (TA0009)
ATT&CK techniques: Screen Capture (T1113)
Attacker's goals:

Evading security controls and collecting screen captures of the desktop.

Investigative actions:

Monitor the command-line arguments of psr.exe and the process causality. Validate the following criteria, if none of them are correct, follow incident response procedures: Check the causality of execution and if the TSS script was executed (Microsoft Troubleshooting Script). If output parameters in the command line are executed by the user. If the parent process is known in the organization as a support tool.

Test period:
N/A (single event)
Deduplication:
1 Day