StealC Screenshot Capture via BitBlt Followed by JPG Write to %TEMP%
Detects anomalous screen capture activity associated with StealC malware. It identifies when a non-UI process creates a JPEG file within the system temporary directory followed immediately by an outbound network connection from the same process, which is indicative of the malware capturing a screenshot and staging it for exfiltration.
YARA-L
