Rule Info
Name
SUSP_Screen_Capture_Indicators_Sep26
Author
Swachchhanda Shrawan Poudel
Description
Detects scripts or binaries containing code indicative of screen capture. It doesn't automatically mean the script or binary is malicious, so further analysis is required
Score
65
Reference
Internal Research
Date
2026-09-16
Minimum Yara
3.5.0
Rule Hash
d2c58163c9caccd9666d4d14a22da25c
Tags
['SUSP', 'SCRIPT', 'T1113']
Required Modules
[]
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
10
Suspicious (< 10 engines)
5
Clean (0 engines)
18
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR