System.Drawing.ni.dll Load for Potential Screen Capture
This rule detects when the "System.Drawing.ni.dll" library is loaded by a process. This DLL is often used for graphical operations, including screen capturing. Its loading can indicate an attempt to capture screen content, which is a common technique used by adversaries for reconnaissance or data exfiltration.
Sigma
