PowerShell Screen Capture via System.Windows.Forms or CopyFromScreen T1113

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

This rule detects the use of PowerShell commands that leverage Windows Forms or GDI APIs (e.g., System.Windows.Forms.Screen, System.Drawing.Bitmap, CopyFromScreen) to perform screen capture. Adversaries often use these native .NET capabilities to capture desktop screenshots during post-exploitation.