I've always been amazed about the sheer amount of service ProcMon can provide, but the topic on detecting screenshots being taken in general remains unexplored for me. If the programs I`m using on a daily basis are maliciously taking screenshots of my screen--and I've good reasons to believe they are--what's the way to detect such behaviour?
I don't believe that Process Monitor is the tool for that. The reason is that it lists Windows messages and events, while taking a screenshot is done by calling API functions, chiefly the BitBlt function.
Only a product that hooks the necessary API calls of all the executing processes can detect taking screenshots, by detecting processes calling functions such as BitBlt while their windows are hidden, minimized, on the traybar or otherwise have no reason for doing it.
There is extensive information about API hooking available, for example
Windows API Hooking Tutorial (Example with DLL Injection).