Your first rule

The goal#

Your organisation does not use the Windows Steps Recorder (psr.exe), which records the screen. You want a signal whenever it is running or ran.

1. Write the rule#

Create the folder C:\signal-rules and save this as C:\signal-rules\psr.json:

[{
  "id": "EXEC-STEPS-RECORDER",
  "module": "Executions",
  "severity": "low",
  "title": "Steps Recorder ran",
  "evidence": ["process_creation", "running_process"],
  "detail": "The Steps Recorder (psr.exe), which records the screen and the user's clicks, ran.",
  "impact": "It is not used here; it can capture what is on the screen, including sensitive data.",
  "focus": "Check the account and time; look for the recording it saved (a .zip, usually in the user's profile).",
  "tags": ["T1113"],
  "notes": "Our policy: the Steps Recorder is not used.",
  "condition": "psr",
  "detection": {
    "psr": {"process.name": {"modifier": "endswith", "values": ["\\psr.exe"]}}
  },
  "tests": [
    {"evidence": "process_creation", "fields": {"process.name": "C:\\Windows\\System32\\psr.exe"}, "expect": "match"},
    {"evidence": "running_process", "fields": {"process.name": "C:\\Tools\\mypsr.exe"}, "expect": "no_match", "note": "a look-alike name"}
  ]
}]

2. Check it#

signal rules -check -rules C:\signal-rules

The check loads the rule, confirms it names its evidence and explains itself, and runs its two tests. Every problem is named, with its line and column for a JSON mistake.

3. See it fire#

1. Start the Steps Recorder

   Press Win+R, type psr, Enter. Leave its window open.

2. Run Signal with your rule

   signal live -m Executions -rules C:\signal-rules -o .\

3. Find your signal

   Search the run for EXEC-STEPS-RECORDER: one signal, evidence running_process, and - if Process Creation auditing is on - its creation too, as one signal.

4. Close the Steps Recorder

   Close its window.

4. Break it on purpose#

Change the first test's process.name to C:\Windows\System32\notepad.exe and check again. The failure tells you which selection did not match and what the record held:

FAIL  EXEC-STEPS-RECORDER                  C:\signal-rules\psr.json
        test 1: must match, did not - condition "psr"; psr: false (process.name endswith "\psr.exe"; the record's is "C:\Windows\System32\notepad.exe")

Put it back. You have written, tested and run your first rule.

Next#

The full rule syntax.