Screen Capture with Xwd

SigmaHQ Detections@sigmaHQ

•updated Dec 8, 2025•0•0•0

Detects adversary creating screen capture of a full with xwd. Highly recommended using rule on servers, due high usage of screenshot utilities on user workstations