Snipping Tool Launched with Remote SMB Resource in filePath
Detects Snipping Tool abuse through the ms-screensketch protocol with a UNC path in the filePath parameter, which may trigger outbound SMB authentication and NTLM hash leakage.
Sigma
Detects Snipping Tool abuse through the ms-screensketch protocol with a UNC path in the filePath parameter, which may trigger outbound SMB authentication and NTLM hash leakage.
Already have an account?