SparroWocky backdoor process invoking screen-capture APIs

Ankit Mehta@Secvyn

•updated Sep 17, 2026•0•0•2

This rule detects the suspicious loading of known SparroWocky loader DLLs (winfsp-x64.dll or DukeQt.dll) into a process, followed by that same process loading graphics-related libraries (gdi32.dll, gdi32full.dll, or user32.dll) within a 10-minute window. This behavioral pattern is indicative of the backdoor's screen-capture capability, as these GDI/User32 modules are required for capturing screen content.