From 609e55aa5818d79709c55df652c3ecd2c130e8eb Mon Sep 17 00:00:00 2001
From: re-fox <57954766+re-fox@users.noreply.github.com>
Date: Wed, 29 Jul 2020 15:18:50 -0400
Subject: [PATCH] Update capture-screenshot.yml

Extended to catch a copy of the screenshot functionality in arkei_stealer sample `7204e3efc2434012e13ca939db0d0b02`
---
 collection/screenshot/capture-screenshot.yml | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/collection/screenshot/capture-screenshot.yml b/collection/screenshot/capture-screenshot.yml
index cd445a7e..28ff35b7 100644
--- a/collection/screenshot/capture-screenshot.yml
+++ b/collection/screenshot/capture-screenshot.yml
@@ -2,18 +2,26 @@ rule:
   meta:
     name: capture screenshot
     namespace: collection/screenshot
-    author: moritz.raabe@fireeye.com
+    author: 
+      - moritz.raabe@fireeye.com
+      - "@_re_fox"
     scope: function
     att&ck:
       - Collection::Screen Capture [T1113]
     examples:
       - BFB9B5391A13D0AFD787E87AB90F14F5:0x1314610A
+      - 7204e3efc2434012e13ca939db0d0b02:0x414070
   features:
     - and:
       - or:
         - api: user32.GetWindowDC
         - api: user32.GetDC
-      - api: gdi32.BitBlt
+        - and:
+          - api: gdi32.CreateDCA
+          - string: DISPLAY
+      - or:
+        - api: gdi32.BitBlt
+        - api: gdi32.GetDIBits
       - api: gdi32.CreateCompatibleDC
       - api: gdi32.CreateCompatibleBitmap
       - optional: