Anomalous SnippingTool.exe Network Activity - Snipping Tool NTLM Leak
Detects unusual network connections initiated by the Windows Snipping Tool. While SnippingTool may occasionally connect for telemetry or updates, active outbound connections to non-Microsoft endpoints are highly suspicious and could indicate process injection or masquerading.
Microsoft Sentinel (KQL)
