ATT&CK T1113 - Screen Capture Exfil: PNG Upload

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects the upload of a PNG image file over HTTP using a POST request. This could indicate an attacker exfiltrating screen captures, which aligns with MITRE ATT&CK technique T1113 (Screen Capture). The rule specifically looks for the HTTP POST method and the PNG file signature (89 50 4E 47) within the file data.