Remcos RAT Screen Capture via BitBlt or CopyFromScreen GDI API
Detects suspicious API calls related to remote thread creation, memory allocation, and screen capturing, along with image loads of GDI32.dll from unusual paths and specific file activity. This rule also identifies processes associated with known malicious software product names.
Microsoft Sentinel (KQL)
