TWINLOOT Fake Lock Screen Window Class Creation with GetUserNameExW Harvest
Detects TWINLOOT's fake lock screen credential harvesting technique, where the implant creates a window using highly unique class names (launcher_black_screen_31337, launcher_fake_lockscreen_view) to simulate a Windows lock screen and then calls GetUserNameExW to capture the logged-on user's credentials without validation, feeding harvested credentials into subsequent lateral movement.
Sigma
