| elastic |
Potential Remote Desktop Shadowing Activity |
production |
2026-09-18 |
| elastic |
PowerShell Suspicious Script with Screenshot Capabilities |
production |
2026-09-18 |
| elastic |
Linux Video Recording or Screenshot Activity Detected |
production |
2026-09-18 |
| splunk |
Windows Screen Capture in TEMP folder |
production |
2026-08-14 |
| splunk |
Suspicious WAV file in Appdata Folder |
production |
2026-05-13 |
| splunk |
Windows Screen Capture Via Powershell |
production |
2026-05-13 |
| splunk |
Remcos RAT File Creation in Remcos Folder |
production |
2026-05-13 |
| splunk |
Suspicious Image Creation In Appdata Folder |
production |
2026-05-13 |
| sigma |
Periodic Backup For System Registry Hives Enabled |
test |
2024-07-01 |
| sigma |
Windows Recall Feature Enabled - Registry |
test |
2024-06-02 |
| sigma |
Windows Recall Feature Enabled Via Reg.EXE |
test |
2024-06-02 |
| sigma |
Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted |
test |
2024-06-02 |
| sigma |
Screen Capture Activity Via Psr.EXE |
test |
2024-01-04 |
| sigma |
System Drawing DLL Load |
test |
2023-02-22 |
| sigma |
Screen Capture with Xwd |
test |
2022-12-18 |
| sigma |
Screen Capture with Import Tool |
test |
2022-10-09 |
| sigma |
Windows Screen Capture with CopyFromScreen |
test |
2022-07-07 |
| sigma |
Screen Capture - macOS |
test |
2021-11-27 |