PowerShell Add-Type Keylogging/Screen Capture Detection

Daniel Jeremiah@daniyyell

•updated Jun 14, 2026•2•0•12

Detects PowerShell using the Add-Type cmdlet to dynamically compile C# code referencing keylogging (SetWindowsHookEx) or screen capture (CopyFromScreen) APIs. This behavior is indicative of PS1Bot in-memory module execution.