Microsoft SysInternals recently updated the Sysmon and ZoomIt components

InfoSec Handlers Diary Blog – SANS Internet Storm Center

Both Sysinternals utilities (Sysmon and ZoomIt) received updates that significantly extends their scope: Sysmon can now also block actions, and ZoomIt can record videos.  Sysmon Event 27 (FileBlockExecutable) can now be used to block writing of executables to disk, when they match the given conditions.  ZoomIt   While ZoomIt is not a security tool, it can be handy while presenting to zoom in on your screen.  And now it can record your screen too: