Correlated webcam, screenshot, and keystroke/clipboard dump activity from single unrecognized process (Dolphin X surveillance)
Detects a single unrecognized process combining two or more distinct PRO/ULTIMATE surveillance behaviors: webcam capture via Win32 Media Foundation, screenshot/screen-recorder file drops, and keystroke/clipboard dump file creation, within a short 15-minute window. Excludes known legitimate screen-recording, remote-support, and accessibility software.
Microsoft Sentinel (KQL)
