Covert Screen/Audio Capture via FFmpeg or OBS Spawned by Script Interpreter
Detects the execution of multimedia capturing utilities like ffmpeg or OBS Studio when spawned by common scripting or administrative processes. This pattern often indicates unauthorized screen, audio, or video recording potentially used in data exfiltration or reconnaissance.
SentinelOne
