SIGHTGRAB screenshot utility execution and JPG drop in Public\Videos

Ibrahim Saud@tektrix

•updated Jul 2, 2026•0•0•2

This rule detects the execution of a process named 'sightgrab.exe' or the creation of suspicious JPG files within the 'C:\Users\Public\Videos\' directory. This activity is indicative of credential or data harvesting tools, often used to capture screenshots or sensitive user data, followed by staging the captured files in public-accessible folders.