Possible collection of screen captures with Windows Problem Steps Recorder

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent
ATT&CK Tactic	Collection (TA0009)
ATT&CK Technique	Screen Capture (T1113)
Severity	Medium

Description

Windows Problem Steps Recorder (psr.exe), can record screen and clicks. Adversaries may abuse psr.exe to create screen captures and collect them afterward.

Attacker's Goals

Evading security controls and collecting screen captures of the desktop.

Investigative actions

Monitor the command-line arguments of psr.exe and the process causality. Validate the following criteria, if none of them are correct, follow incident response procedures:

• Check the causality of execution and if the TSS script was executed (Microsoft Troubleshooting Script).
• If output parameters in the command line are executed by the user.
• If the parent process is known in the organization as a support tool.