Screen Capture via Snipping Tool or Screen Sketch ( CVE-2026-33829 )

Ankit Mehta@Secvyn

•updated Apr 16, 2026•9•0•313

Detects the execution of Windows Snipping Tool (SnippingTool.exe) or Screen Sketch (ScreenSketch.exe) when launched with the 'ms-screensketch' command-line argument. This behavior is indicative of a user or process taking a screenshot, which could be part of information gathering by an adversary.