Clipboard and screenshot staging pair

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•3•0•20

This rule detects the creation of 'Clipboard.txt' and 'Screenshot.bmp' files by the same process, indicating potential data staging activities. It leverages XQL to maintain actor and causality fields for investigation.