OnyxC2 keylogger hook and periodic screenshot staging
Detects a low-level keyboard hook or screen-capture API call from an unsigned, non-standard-path process, correlated with periodic image/keystroke buffer file staging, consistent with OnyxC2's premium keylogger/screenshot module.
Microsoft Sentinel (KQL)
