iTop Screen Recorder or Krisp/Caption.Ed co-occurring with video conferencing
Detects screen-recording or AI voice-transcription applications (iTop Screen Recorder, Krisp, Caption.Ed) running within 60 minutes of an active videoconferencing session, consistent with PurpleDelta operators recording or transcribing interviews or meetings to generate scripted answers.
Microsoft Sentinel (KQL)
