Windows Screen Capture via CopyFromScreen in PowerShell
This rule detects the use of '.CopyFromScreen' within PowerShell script block text. This API call is commonly used by adversaries to capture screenshots of the desktop, which is a technique for gathering information during an operation. The detection relies on PowerShell Script Block Logging being enabled to capture the script content.
Sigma
