ChainScript screenshot helper SearchTrustedRuntimeSvc.exe masquerading as Captur

Kaung Khant Ko@kaungkhantko

•updated Sep 21, 2026•1•0•4

This rule detects potential screen capture activity performed by either a suspicious executable (SearchTrustedRuntimeSvc.exe) that mimics a screen capture tool or a PowerShell script invoked by Node.js using .NET drawing libraries. This behavior is indicative of unauthorized information gathering, common in remote access trojans (RATs).