Sunturai
Back to results
InformationalSplunk security contentRaven Tait +1

Windows Process Accessing Windows Recall Directory

This detection triggers on a process accessing the Windows Recall directory. Recall is a new feature Microsoft release that takes screenshots every 5 or so seconds to provide context to it's AI features. The initial…

Description

This detection triggers on a process accessing the Windows Recall directory. Recall is a new feature Microsoft release that takes screenshots every 5 or so seconds to provide context to it's AI features. The initial release of Recall was lacking in the security department due to it being trivial to view and steal the data. Due to this lack of security it's likely that info stealer malware will take advantage of this new feature. Microsoft has recognized the security issues with Recall and is planning on making improvements. Once those improvements are released we will re-assess this detection to make sure it is still relevant.

Detection logic

Detection requirements

Platform
ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows

The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.

Log source category
windows_event_log_security_4663

Known benign triggers

  • Legitimate system processes and trusted applications may access the Windows Recall directory for AI-related features. Review and allow access for approved software as needed.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice