PowerShell Screen Capture via .NET Forms/Drawing Writing Files to TMP

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•5

Detects PowerShell processes using .NET screen capture libraries (System.Windows.Forms/Drawing) to generate image files in common staging directories like Temp or Public folders, which is a common pattern for malicious screen capture exfiltration.