Argamal RAT Screenshot Capture via System.Drawing.CopyFromScreen and ~wra1269.tmp

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•4

Detects evidence of Argamal RAT activity involving screenshot capture using .NET Graphics.CopyFromScreen methods written to a specific temporary file (~wra1269.tmp). The rule monitors both PowerShell execution patterns and file creation events associated with this specific artifact.