Sigma rule: Screen Capture with Import Tool

Rule

Title

Screen Capture with Import Tool

Status

test

Level

low

Author

Pawel Mazur

Date

2021-09-21

Modified

2022-10-09

File

rules/linux/auditd/execve/lnx_auditd_screencapture_import.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects adversary creating screen capture of a desktop with Import Tool.
Highly recommended using rule on servers, due to high usage of screenshot utilities on user workstations.
ImageMagick must be installed.

Log source

product

linux

service

auditd

Detection

import:
    type: EXECVE
    a0: import
import_window_root:
    a1: '-window'
    a2: 'root'
    a3|endswith:
        - '.png'
        - '.jpg'
        - '.jpeg'
import_no_window_root:
    a1|endswith:
        - '.png'
        - '.jpg'
        - '.jpeg'
condition: import and (import_window_root or import_no_window_root)

False positives (as the rule lists them)

• Legitimate use of screenshot utility

Tags

• attack.collection
• attack.t1113

MITRE ATT&CK ids this rule names

• T1113

References

• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md
• https://linux.die.net/man/1/import
• https://imagemagick.org/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/auditd/execve/lnx_auditd_screencapture_import.yml