Mirage Kitten NightLedge - Screenshot Capture from Hijacked DLL Execution Context
Detects NightLedger Command 36 (screenshot capture) by anchoring the ScreenshotTaken event to the implant's known execution context rather than relying on a blocklist of legitimate tools. NightLedger executes inside a DLL side-loaded by AppVShNotify.exe or related LOLBin processes, and stages under user-writable paths consistent with the group's known deployment locations (LocalAppData\Microsoft\VisualStudio, univpn\promote, etc.). The compound condition; screenshot event AND suspicious initiating process path or LOLBin loader; produces high-confidence detections with minimal enterprise noise.
Microsoft Sentinel (KQL)
