PowerShell Screenshot Capture via CopyFromScreen to shot.png from pythonw.exe implant
Detects PowerShell invoking the .NET CopyFromScreen method to capture a screenshot and write it to shot.png, spawned as a child process of pythonw.exe. This behavior matches the TWINLOOT Python implant, which abuses trusted Microsoft cloud services for C2 and uses pythonw.exe to launch PowerShell for screen capture as part of its credential harvesting and reconnaissance capabilities.
Sigma
