Screen Capture Activity Via Psr.EXE (2158f96f-43c2-43cb-952a-ab4580f32382)
Detects execution of Windows Problem Steps Recorder (psr.exe), a utility used to record the user screen and clicks.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Screen Capture - T1113 (0259baeb-9f63-4c69-bf10-eb038c390688) | Attack Pattern | Screen Capture Activity Via Psr.EXE (2158f96f-43c2-43cb-952a-ab4580f32382) | Sigma-Rules | 1 |