GammaSteel FileSystemWatcher Spying
Detects the initiation of a FileSystemWatcher object in PowerShell configured to monitor the 'Changed' event. This technique is used by GammaSteel to actively monitor user operations in real time and steal documents the moment they are modified.
Sigma
