System Drawing DLL Load — Detection Rule

Detects processes loading "System.Drawing.ni.dll". This could be an indicator of potential Screen Capture.

Read the full analysis on IntelFusions