Skip to content

LIVING OFF THE LAND / OS BINARIES

Psr.exe

Windows Problem Steps Recorder, used to record screen and clicks.

01COMMAND EXAMPLES

01ATT&CK TECHNIQUES

01DETECTION RESOURCES

01CAPABILITIES

01 / TRADECRAFT

Command reference

1 examples

Reconnaissance1

EXAMPLE 01T1113

Record a user screen without creating a GUI. You should use "psr.exe /stop" to stop recording and create output file.

COMMAND

psr.exe /start /output {PATH_ABSOLUTE:.zip} /sc 1 /gui 0

USE CASE: Can be used to take screenshots of the user environment
PRIVILEGES: User
OPERATING SYSTEM: since Windows 7 (client) / Windows 2008 R2

02 / ON DISK

Known paths

c:\windows\system32\psr.exe

c:\windows\syswow64\psr.exe

03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Sigmaproc_creation_win_psr_capture_screenshots.ymlgithub.com

Indicators & detection notes

IOC
psr.exe spawned
IOC
suspicious activity when running with "/gui 0" flag

FURTHER READING

Research & resources

READ51722.windows problem steps recorder psr quick and easy documenting of your steps and procedures.aspxsocial.technet.microsoft.com

COMMUNITY RESEARCH

Acknowledgements

Leon Rodenko@L3m0nada