Remcos RAT Screen Capture via Screenshot Files Written to AppData\Roaming\Screenshots

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects the presence of Remcos RAT executable files or the creation of screenshot files by non-standard processes, commonly used for remote surveillance.