Suspicious Execution of Screen Capture Utilities

Shadows VMB@Vemorian_Mort

•updated Aug 25, 2026•9•0•16

Detects the execution of known screen capture and sniping tools (such as SnippingTool, Greenshot, ShareX, OBS, etc.) when initiated from potentially suspicious user-controlled directories like AppData, Temp, or Downloads. This behavior may indicate an attempt to capture sensitive desktop information or credentials.