Remcos RAT Screenshot Capture via GDI BitBlt to Temp Directory
Detects the creation or writing of BMP files in temporary directories by processes other than common screenshot or image editing tools. This activity can be indicative of malware attempting to capture screenshots or other visual data, potentially for exfiltration or analysis.
Cortex XDR
