SIGHTGRAB Screenshot Files Written to Public Videos Directory
Detects the creation of sequentially numbered JPEG files within timestamped subdirectories of C:\Users\Public\Videos. This activity is consistent with the behavior of the SIGHTGRAB utility, a tool used by the threat actor UNC1549 for intelligence gathering through automated desktop screenshots.
Sigma
