Screen Capture with Import Tool

Title: Screen Capture with Import Tool
Status: test
Description:Detects adversary creating screen capture of a desktop with Import Tool. Highly recommended using rule on servers, due to high usage of screenshot utilities on user workstations. ImageMagick must be installed.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md
  -https://linux.die.net/man/1/import
  -https://imagemagick.org/
Author: Pawel Mazur
Date: 2021-09-21
modified:2022-10-09
Tags:

• -'attack.collection'
• -'attack.t1113'

Logsource:

• product: linux
• service: auditd

Detection:
  import:
    type: 'EXECVE'
    a0: 'import'
  import_window_root:
    a1: '-window'
    a2: 'root'
    a3|endswith:
      -'.png'
      -'.jpg'
      -'.jpeg'

  import_no_window_root:
    a1|endswith:
      -'.png'
      -'.jpg'
      -'.jpeg'

  condition:import and (import_window_root or import_no_window_root)
Falsepositives:
  -Legitimate use of screenshot utility
Level: low