NightLedger Screen Capture via GDI Screenshot API Load in AppVShNotify.exe
Detects loading of the GDI screen-capture library (gdi32full.dll/gdi32.dll) specifically within the AppVShNotify.exe process, which is hijacked/sideloaded by NightLedger to implement Command ID 36 ("take a screenshot") visual reconnaissance capability. Scoping to the rogue AppVShNotify.exe process context (rather than any process loading GDI screenshot APIs) reduces false positives from legitimate remote-access and screenshot utilities that commonly use these APIs. Excludes legitimate AppVShNotify.exe executing from the standard Microsoft Application Virtualization Client install path.
Sigma
