Screen Capture with Import Tool

SigmaHQ Detections@sigmaHQ

•updated Dec 8, 2025•0•0•0

Detects adversary creating screen capture of a desktop with Import Tool. Highly recommended using rule on servers, due to high usage of screenshot utilities on user workstations. ImageMagick must be installed.