GDI Screen Capture (BitBlt/GetDIBits) by NVIDIA-Masquerading LabubaRAT Implant
Detects the use of GDI functions (GetDC, CreateCompatibleBitmap, BitBlt, GetDIBits) combined with suspicious base64 encoding activity by a process masquerading as an NVIDIA binary (nvidia-sysruntime.exe). This behavior is indicative of screen capture and exfiltration attempts typical of the LabubaRAT implant.
Microsoft Sentinel (KQL)
