CVE-2026-33829 Windows Snipping Tool Vulnerability

Lightkun Yagami@lightkun_CrowdStriker

•updated Apr 18, 2026•19•0•271

This searches for both network and process events. Shows only public IP addresses, and drops any empty IP address field. Enriches the search with any of the three ImageFileNames: SnippingTool.exe, ScreenSketch.exe, and SnipAndSketch.exe, and only where ms-screensketch is in the commandline. The result will be in a table format showing the timestamp, computername, imagefile name, remote IPv4 address, and the commandline.