kqlElastic-2.0from elastic/detection-rules

PowerShell Suspicious Script with Screenshot Capabilities

Quality

FP risk

—

Forks

Views

ATT&CK techniques

T1113 T1059 T1059.001

Rule sourcerules/windows/collection_posh_screen_grabber.toml

event.category:process and host.os.type:windows and
  powershell.file.script_block_text : (
    CopyFromScreen and
    ("System.Drawing.Bitmap" or "Drawing.Bitmap")
  ) and not user.id : "S-1-5-18"