Snipping Tool NTLM Leak via ms-screensketch filePath UNC Path
Detects exploitation attempts for CVE-2026-33829 where the Snipping Tool ms-screensketch URI schema is abused with a remote UNC path in the filePath parameter, potentially coercing SMB authentication and leaking Net-NTLM credentials.
Sigma
