Screen Capture - macOS

Title: Screen Capture - macOS
Status: test
Description:Detects attempts to use screencapture to collect macOS screenshots
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md
  -https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/python/collection/osx/screenshot.py
Author: remotephone, oscd.community
Date: 2020-10-13
modified:2021-11-27
Tags:

• -'attack.collection'
• -'attack.t1113'

Logsource:

• product: macos
• category: process_creation

Detection:
  selection:
    Image: '/usr/sbin/screencapture'
  condition:selection
Falsepositives:
  -Legitimate user activity taking screenshots
Level: low