DcRAT GDI Screen Capture via Injected Svchost — Operation DragonReturn T1113

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects potential DcRAT activity characterized by a process spawning under a svchost.exe parent, subsequent loading of GDI display libraries for screen capturing, and outbound network communication on non-standard ports, which indicates data exfiltration.