Backdoor.Mistic Screen Capture via MpExtMs.exe

Kaung Khant Ko@kaungkhantko

•updated Jun 25, 2026•2•0•14

This rule detects the suspicious loading of gdi32.dll and the execution of BitBlt functions (CreateBitmap or BitBlt) by the process MpExtMs.exe. This pattern is indicative of the Backdoor.Mistic malware, which uses these GDI functions to perform unauthorized screen captures.