Edgecution screen capture with concurrent FTK Imager/Edge on Domain Controller
Detects screenshot capture events on domain controllers occurring while both FTK Imager and Microsoft Edge processes are running within the same 15-minute window, consistent with UNC6692's Edgecution malware suite deployment where attackers use FTK Imager for forensic/data collection and Edge (loaded with a malicious extension) as the Edgecution backdoor, alongside screen capture activity for surveillance/monitoring of compromised domain controllers.
Microsoft Sentinel (KQL)
