Screen Capture Activity Via Psr.EXE
Detects the execution of the Windows Problem Steps Recorder (psr.exe) with command-line arguments indicating a recording start. Psr.exe is a legitimate utility that can be abused by adversaries to capture screen activity, which is a form of information collection.
Sigma
