Remcos RAT Screenshot Capture via GDI APIs - AppData Image Write
Detects potential screen capture activity by the Remcos RAT by monitoring for image file creation in the AppData\Roaming\Screenshots directory with specific naming patterns ('time_' or 'wnd_'). The rule scopes this to processes executing from suspicious paths such as AppData or ProgramData, while filtering known legitimate screen capture software.
Sigma
