add rule win_susp_capture_screenshots.yml

rules/windows/process_creation/win_susp_capture_screenshots.yml

@@ -0,0 +1,23 @@
+title: psr.exe capture screenshots
+status: experimental
+description: The psr.exe captures desktop screenshots and saves them on the local machine
+references:
+    - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/LOLUtilz/OSBinaries/Psr.yml
+    - https://www.sans.org/summit-archives/file/summit-archive-1493861893.pdf
+author: Beyu Denis, oscd.community
+date: 2019/10/12
+tags:
+    - attack.persistence
+    - attack.t1218
+level: medium
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection:
+        Image: '*\Psr.exe'
+        CommandLine: '*/start*'
+    condition: selection 
+falsepositives:
+    - Unknown
+