{"id":"0877ed01-da46-4c49-8476-d49cdd80dfa7","title":"Screen Capture - macOS","description":"Detects attempts to use screencapture to collect macOS screenshots","author":"remotephone, oscd.community","status":"test","level":"low","date":"2020-10-13","modified":"2021-11-27","tags":["attack.collection","attack.t1113"],"technique_ids":["T1113"],"logsource":{"product":"macos","category":"process_creation"},"falsepositives":["Legitimate user activity taking screenshots"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md","https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/python/collection/osx/screenshot.py"],"source_path":"rules/macos/process_creation/proc_creation_macos_screencapture.yml","source_sha256":"f981cd894c5300a5d2a665121c1d206c0aad383b34b7054b04a56345c2c1bb73","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_screencapture.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Screen Capture - macOS\nid: 0877ed01-da46-4c49-8476-d49cdd80dfa7\nstatus: test\ndescription: Detects attempts to use screencapture to collect macOS screenshots\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md\n    - https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/python/collection/osx/screenshot.py\nauthor: remotephone, oscd.community\ndate: 2020-10-13\nmodified: 2021-11-27\ntags:\n    - attack.collection\n    - attack.t1113\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection:\n        Image: '/usr/sbin/screencapture'\n    condition: selection\nfalsepositives:\n    - Legitimate user activity taking screenshots\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1113","id":"T1113","name":"Screen Capture","page":"techniques/enterprise/T1113/"}],"data_path":"data/detection-rules/0877ed01-da46-4c49-8476-d49cdd80dfa7.json","kind":"sigma"}