Infostealer Desktop Screenshot and Clipboard Capture via StealC
This rule detects infostealer activity involving desktop screenshot capture and clipboard monitoring, which are common tactics used by the StealC infostealer family to harvest sensitive information. The detection triggers when known StealC binaries execute or when native Windows utilities like the Snipping Tool or PSR are launched by suspicious parent processes associated with this malware.
Sigma
