PS1Bot Screenshot File Creation

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•6

Detects the creation of 'Screenshot.jpg' in the AppData directory by PowerShell. This activity is often associated with malware like PS1Bot attempting to capture screenshots of the user's desktop.