T0852 Screen Capture — Detection Rules

Source-backed rule directory

No reviewed association in this snapshot.

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0751 Detection of Screen Capture

AN1883 Analytic 1883

Real-time monitoring identifies execution of screenshot utilities (scrot, import, xwd) on an Industrial Control System (ICS) Linux Human-Machine Interface (HMI), from a User Identifier (UID) that does not normally perform display operations. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

AN2250 Analytic 2250

Real-time monitoring identifies Hypertext Transfer Protocol (HTTP) requests to an embedded Human-Machine Interface (HMI) panel's built-in web server capturing screen images, or Virtual Network Computing (VNC) connections to embedded HMI panels, from source Internet Protocol (IP) addresses not in the approved operator workstation list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

AN2274 Analytic 2274

Real-time monitoring identifies a process invoking screen capture Application Programming Interfaces (APIs) targeting an Human-Machine Interface (HMI) or operator workstation window, where the calling process is not a recognized Industrial Control System (ICS) vendor application or approved remote support tool, immediately followed by an image file write. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.