Refactor screenshot rule to remove duplication

mandiant · Feb 25, 2025 · adb3858 · adb3858
1 parent 4cd4879
commit adb3858
Showing 1 changed file with 5 additions and 11 deletions.
diff --git a/collection/screenshot/capture-screenshot.yml b/collection/screenshot/capture-screenshot.yml
@@ -22,14 +22,16 @@ rule:
       - de5f2dd641b3e75eea6e4575b0ba4a48:0x140002180
   features:
         # Classic GDI Capture
-    - or:
+
+    - or: 
       - and:
         - or:
           - api: user32.GetWindowDC
           - api: user32.GetDC
           - and:
             - api: gdi32.CreateDC
-            - string: "DISPLAY"
+            - optional:
+                - string: "DISPLAY"
         - or:
           - api: gdi32.BitBlt
           - api: gdi32.GetDIBits
@@ -47,26 +49,18 @@ rule:
         - and:
           - api: BitBlt
       - api: System.Drawing.Graphics::CopyFromScreen
-
       - and:
-        - or:
-          - api: "GetDC"
-          - and:
-            - api: "CreateDC"
-            - optional:
-              - string: "DISPLAY"
         - or:
           - and:
             - api: "SelectObject"
             - api: "DrawText"
           - and:
-            - api: "CreateCompatibleDC"
-            - api: "CreateCompatibleBitmap"
             - or:
               - api: "BitBlt"
               - api: "StretchBlt"
               - api: "PrintWindow"
 
+
       # GDI+ Graphics API chain
       - and:
         - api: "GdipCreateBitmapFromScan0"