All Detections

PS1Bot Screen Capture

avatar
Ibrahim Saud@tektrix
updated Jun 17, 2026003

Detects PowerShell utilizing .NET Graphics classes to perform screen capture, specifically looking for the use of 'System.Drawing.Graphics', 'CopyFromScreen', and 'Bitmap' in the process command line.

Microsoft Sentinel (KQL)