Windows Screen Capture via PowerShell CopyFromScreen

Adversaries frequently employ screen capture techniques to exfiltrate sensitive data or monitor user activity following an initial compromise. A common, lightweight method observed in post-compromise operations involves the abuse of .NET classes available within the PowerShell environment. Specifically, attackers utilize the 'CopyFromScreen' method of the 'System.Drawing.Graphics' class to programmatically capture the desktop and save it as an image file. This technique is often integrated into custom remote access tools or lightweight reconnaissance scripts to avoid the overhead of deploying full-featured malware. Because it leverages built-in Windows APIs via PowerShell, defenders can detect this activity by monitoring PowerShell Script Block Logging for the instantiation of these specific graphics classes.

Impact

Successful execution allows attackers to exfiltrate sensitive information visible on the victim's screen, such as credentials, internal documentation, or ongoing communications. This collection phase is a critical step in reconnaissance and exfiltration workflows, increasing the risk of data exposure for the compromised host.

Recommendation

• Enable PowerShell Script Block Logging (Event ID 4104) across all Windows endpoints to ensure the visibility of script content.
• Deploy the provided Sigma rule to detect the use of the .CopyFromScreen method in PowerShell scripts.
• Establish an alert for PowerShell execution where the script content references 'System.Drawing.Graphics'.
• Audit environments for administrative or non-standard tools that may legitimately perform screen captures.