Merge pull request #1 from akh7177/add-screenshot-rule

Improve Screenshot Detection by Modifying capture-screenshot.yml

Author: akh7177

collection/screenshot/capture-screenshot.yml

@@ -6,6 +6,7 @@ rule:
       - [email protected]
       - "@_re_fox"
       - [email protected]
+      - "Abhyuday K Hegde"
     scopes:
       static: function
       dynamic: span of calls
@@ -17,7 +18,10 @@ rule:
       - BFB9B5391A13D0AFD787E87AB90F14F5:0x1314610A
       - 7204e3efc2434012e13ca939db0d0b02:0x414070
       - 50D5EE1CE2CA5E30C6B1019EE64EEEC2:0x406E07
+      - 333cf4a403f2dbd56e2509eb2f1d8922:0x140002180
+      - de5f2dd641b3e75eea6e4575b0ba4a48:0x140002180
   features:
+        # Classic GDI Capture
     - or:
       - and:
         - or:
@@ -43,3 +47,48 @@ rule:
         - and:
           - api: BitBlt
       - api: System.Drawing.Graphics::CopyFromScreen
+
+      - and:
+        - or:
+          - api: "GetDC"
+          - and:
+            - api: "CreateDC"
+            - optional:
+              - string: "DISPLAY"
+        - or:
+          - and:
+            - api: "SelectObject"
+            - api: "DrawText"
+          - and:
+            - api: "CreateCompatibleDC"
+            - api: "CreateCompatibleBitmap"
+            - or:
+              - api: "BitBlt"
+              - api: "StretchBlt"
+              - api: "PrintWindow"
+
+      # GDI+ Graphics API chain
+      - and:
+        - api: "GdipCreateBitmapFromScan0"
+        - api: "GdipGetImageGraphicsContext"
+        - api: "GdipGetDC"
+
+      # Direct GDI+ screen copy
+
+      - and:
+        - api: "Gdiplus::Graphics::FromHDC"
+        - api: "Gdiplus::Graphics::CopyFromScreen"
+
+      # DirectX method of screen capture
+      - and:
+        - or:
+          - api: "PrintWindow"
+          - api: "StretchBlt"
+        - and:
+          - api: "DwmGetDxSharedSurface"
+          - optional:
+            - string: "DXGI"
+        - or:
+          - api: "Direct3DCreate9"
+          - api: "IDirect3DDevice9::GetFrontBufferData"
+          - string: "IDirect3DSurface9::GetDC"