Seedworm Screenshot Script sp.ps1 Execution
Detects the execution of a PowerShell script named 'sp.ps1' which has been associated with the Seedworm (also known as Sandworm Team) threat group for gathering screenshots. This rule specifically looks for 'sp.ps1' within process command lines.
Microsoft Sentinel (KQL)
