{"id":"dbe4b9c5-c254-4258-9688-d6af0b7967fd","title":"Screen Capture with Import Tool","description":"Detects adversary creating screen capture of a desktop with Import Tool.\nHighly recommended using rule on servers, due to high usage of screenshot utilities on user workstations.\nImageMagick must be installed.\n","author":"Pawel Mazur","status":"test","level":"low","date":"2021-09-21","modified":"2022-10-09","tags":["attack.collection","attack.t1113"],"technique_ids":["T1113"],"logsource":{"product":"linux","service":"auditd"},"falsepositives":["Legitimate use of screenshot utility"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md","https://linux.die.net/man/1/import","https://imagemagick.org/"],"source_path":"rules/linux/auditd/execve/lnx_auditd_screencapture_import.yml","source_sha256":"83f91d59ded0078c90bcfcf01dcc1886c94360274b6a430c6ea8e342ea3578b6","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/execve/lnx_auditd_screencapture_import.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Screen Capture with Import Tool\nid: dbe4b9c5-c254-4258-9688-d6af0b7967fd\nstatus: test\ndescription: |\n  Detects adversary creating screen capture of a desktop with Import Tool.\n  Highly recommended using rule on servers, due to high usage of screenshot utilities on user workstations.\n  ImageMagick must be installed.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md\n    - https://linux.die.net/man/1/import\n    - https://imagemagick.org/\nauthor: 'Pawel Mazur'\ndate: 2021-09-21\nmodified: 2022-10-09\ntags:\n    - attack.collection\n    - attack.t1113\nlogsource:\n    product: linux\n    service: auditd\ndetection:\n    import:\n        type: EXECVE\n        a0: import\n    import_window_root:\n        a1: '-window'\n        a2: 'root'\n        a3|endswith:\n            - '.png'\n            - '.jpg'\n            - '.jpeg'\n    import_no_window_root:\n        a1|endswith:\n            - '.png'\n            - '.jpg'\n            - '.jpeg'\n    condition: import and (import_window_root or import_no_window_root)\nfalsepositives:\n    - Legitimate use of screenshot utility\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1113","id":"T1113","name":"Screen Capture","page":"techniques/enterprise/T1113/"}],"data_path":"data/detection-rules/dbe4b9c5-c254-4258-9688-d6af0b7967fd.json","kind":"sigma"}