Screen Capture with Xwd — Detection Rule

Detects adversary creating screen capture of a full with xwd. Highly recommended using rule on servers, due high usage of screenshot utilities on user workstations

Read the full analysis on IntelFusions