MalCommands

#					tactics	techniques	os

detail

Command Line

psr.exe /start /output D:\test.zip /sc 1 /gui 0

Description

Use psr to start a screen-recording without a GUI and save the output to test.zip.

Risk

High

Risk Reason

This type of action can reveal sensitive information and is abnormal for most users to execute.

Fidelity

Medium

Fidelity Reason

If psr is in common use at an organization, this may be difficult to alert on.

Operating Systems

Windows

Killchain Phases

Actions on Objectives

References

https://lolbas-project.github.io/lolbas/Binaries/Psr/

TOOL DATA

Tool Name: Psr

Tool URL: https://learn.microsoft.com/en-us/office/troubleshoot/settings/how-to-use-problem-steps-recorder

Tool Description: Problem Steps Recorder (psr.exe) is a Microsoft utility used to record the active screen and clicks for troubleshooting assistance.

Common Tool Locations

C:\windows\system32\psr.exe
C:\windows\syswow64\psr.exe

Common Tool Arguments

/start - Start Recording
/output - Provide an output file
/gui - Enable or Disable GUI Creation

MITRE ATT&CK TECHNIQUES

Technique: T1113 - Screen Capture

URL: https://attack.mitre.org/techniques/T1113

Description: Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.(Citation: CopyFromScreen .NET)(Citation: Antiquated Mac Malware)

Tactics:

Collection