StealC/Amadey Infostealer GDI Screen Capture via BitBlt API
Detects suspicious screen capture activity by non-UI processes. This rule identifies instances where a process invokes GDI BitBlt/PrintWindow or CopyFromScreen APIs, followed by writing a JPEG screenshot file to disk, particularly from temporary or program data folders. This behavior is consistent with infostealers like StealC and Amadey.
Microsoft Sentinel (KQL)
