Windows Process Accessing Windows Recall Directory — Detection Rule
This detection triggers on a process accessing the Windows Recall directory. Recall is a new feature Microsoft release that takes screenshots every 5 or so seconds to provide context to it's AI features. The initial release of Recall was lacking in the security department due to it being trivial to view and steal the data. Due to this lack of security it's likely that info stealer malware will take advantage of this new feature. Microsoft has recognized the security issues with Recall and is planning on making improvements. Once those improvements are released we will re-assess this detection to make sure it is still relevant.