Screen Capture with ImageMagick's Import Tool

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

This rule detects the use of the 'import' command, part of ImageMagick, to capture screenshots on a Linux system. It specifically looks for executions of 'import' where the arguments indicate a full-screen capture (using '-window root') or a general screenshot saved to a common image file format (PNG, JPG, JPEG). This activity is often associated with adversaries attempting to collect visual information from a compromised system.