TOKYOCORE Webcam Capture via PowerShell System.Drawing Reflection
Detects the use of PowerShell to perform webcam image capture by utilizing .NET reflection with 'System.Drawing' and 'System.Windows.Forms' namespaces. This technique has been identified as being used by the TOKYOCORE ransomware to perform victim surveillance by capturing and saving camera snapshots as PNG files.
Cortex XDR
