Potential PowerShell Screen Capture via Win32 GDI BitBlt

Rule Info

Name
Potential PowerShell Screen Capture via Win32 GDI BitBlt
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects PowerShell ScriptBlock using the Win32 GDI BitBlt API to capture screen content. Attackers use this native approach to silently copy display pixel data without dropping a standalone capture binary, a technique commonly observed in keyloggers, RATs and spyware.
Reference
https://learn.microsoft.com/en-us/windows/win32/api/wingdi/nf-wingdi-bitblt
Date
2026-09-16 00:00:00
Modified
None
Id
899ad581-8fb0-4c86-9194-fcff4fa2c332
Tags
attack.collection attack.t1113
Type
Nextron Sigma feed only (private)

Rule History

THOR Logo  Scan your endpoints, forensic images or collected files with our portable scanner THOR
  Warning: Access to VALHALLA is rate-limited - once you prove unworthy, access gets denied
  Nextron Systems 2022