TOKYOCORE Screenshot Capture (tokyocore_ss.png)
Detects the creation of specific screenshot files associated with the TOKYOCORE ransomware, which uses these images for surveillance and data exfiltration. The rule monitors for the specific file name 'tokyocore_ss.png' or generic 'screenshot.png' files created in directories containing 'screenshots' within the file path.
Cortex XDR
