Rule Content
- title: psr.exe capture screenshots
id: 2158f96f-43c2-43cb-952a-ab4580f32382
status: experimental
description: The psr.exe captures desktop screenshots and saves them on the local
machine
references:
- https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/LOLUtilz/OSBinaries/Psr.yml
- https://www.sans.org/summit-archives/file/summit-archive-1493861893.pdf
author: Beyu Denis, oscd.community
date: 2019/10/12
modified: 2019/11/04
tags:
- attack.persistence
- attack.t1218
level: medium
logsource:
category: process_creation
product: windows
service: null
detection:
selection:
Image|endswith: \Psr.exe
CommandLine|contains: /start
condition: selection
falsepositives:
- Unknown