Linux: Screen Capture via ImageMagick import Tool Outputting Desktop Images

title: "Linux: Screen Capture via ImageMagick import Tool Outputting Desktop Images"
id: 0398b936-292f-40ce-82d2-5dfffb42eca4
status: test
description: This rule identifies execution of the ImageMagick import command on Linux used to generate screen capture images. It flags runs where the import arguments include the -window option with the window identifier set to root, or where output paths/filenames end with .png, .jpg, or .jpeg. Attackers commonly use screenshot utilities to collect visual information from a compromised host, and the rule relies on process execution telemetry from auditd capturing the import invocation and its argument values.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md
  - https://linux.die.net/man/1/import
  - https://imagemagick.org/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_screencapture_import.yml
author: Pawel Mazur, Huntrule Team
date: 2021-09-21
modified: 2022-10-09
tags:
  - attack.collection
  - attack.t1113
logsource:
  product: linux
  service: auditd
detection:
  import:
    type: EXECVE
    a0: import
  import_window_root:
    a1: -window
    a2: root
    a3|endswith:
      - .png
      - .jpg
      - .jpeg
  import_no_window_root:
    a1|endswith:
      - .png
      - .jpg
      - .jpeg
  condition: import and (import_window_root or import_no_window_root)
falsepositives:
  - Legitimate use of screenshot utility
level: low
license: DRL-1.1
related:
  - id: dbe4b9c5-c254-4258-9688-d6af0b7967fd
    type: derived