Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
216 detections
Filters
Last updated
All Time
Detection languages
77
60
14
13
13
Contributors
72
29
26
19
18
Categories
58
58
39
35
28
Platforms
191
12
10
6
5
Products / Services
69
53
12
12
7
MITRE Techniques
18,104
15,609
12,572
8,382
6,201
IDS Classtypes
3
1
1
IDS Protocols
5
This rule detects the use of the 'import' command, part of ImageMagick, to capture screenshots on a Linux system. It specifically looks for executions of 'import' where the arguments indicate a full-screen capture (using '-window root') or a general screenshot saved to a common image file format (PNG, JPG, JPEG). This activity is often associated with adversaries attempting to collect visual information from a compromised system.
Detects the use of the 'xwd' utility to capture screenshots on a Linux system. This rule is particularly relevant for server environments where screenshot utilities are less commonly used by legitimate users, reducing false positives. The detection logic specifically looks for 'xwd' execution with parameters indicating a screen capture, such as '-root' or '-out' followed by a file ending in '.xwd'.
This rule detects the use of '.CopyFromScreen' within PowerShell script block text. This API call is commonly used by adversaries to capture screenshots of the desktop, which is a technique for gathering information during an operation. The detection relies on PowerShell Script Block Logging being enabled to capture the script content.
Detects attempts to use screencapture to collect macOS screenshots
Detects execution of Windows Problem Steps Recorder (psr.exe), a utility used to record the user screen and clicks.
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation.
Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations
Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations
Page 11 of 11