Starland RAT Screenshot Capture and Post-Capture File Deletion

Duo Tech@duotech

•updated Jul 16, 2026•1•0•0

Detects potential screenshot activity by monitoring the creation and subsequent deletion of .png image files by the pythonw.exe process, a pattern observed in Starland RAT post-compromise activity.