Elastic high stable kql

PowerShell Suspicious Script with Screenshot Capabilities

Detects PowerShell script block content that uses CopyFromScreen with .NET bitmap classes to capture screenshots. Attackers use screen capture to collect on-screen information and credentials.

View Source

Detection Logic

event.category:process and host.os.type:windows and
  powershell.file.script_block_text : (
    CopyFromScreen and
    ("System.Drawing.Bitmap" or "Drawing.Bitmap")
  ) and not user.id : "S-1-5-18"

Field Validations

Loading…

Comments (0)

Loading comments...