Linux Import Tool Image Capture via execve with -window root and .png/.jpg output
Flags Linux ImageMagick import executions likely used for desktop screenshot capture to PNG/JPG outputs or root window.
- Product
- linux
- Service
- auditd
- Author
- Pawel Mazur (SigmaHQ), DRL 1.1
- Published
- 2021-09-21
- Updated
- 2026-07-31
ATT&CK techniques
CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Linux processes executing the ImageMagick import command to capture a desktop or window and write output files with .png, .jpg, or .jpeg extensions. It further narrows matches where the import invocation includes a -window argument targeting root, a pattern commonly associated with screenshot collection. The detection relies on auditd/execve telemetry capturing the import executable name and its command-line arguments.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md
- linux.die.nethttps://linux.die.net/man/1/import
- imagemagick.orghttps://imagemagick.org/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_screencapture_import.yml
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux Import Tool Image Capture via execve with -window root and .png/.jpg output
id: 0398b936-292f-40ce-82d2-5dfffb42eca4
status: test
description: This rule identifies Linux processes executing the ImageMagick import command to capture a desktop or window and write output files with .png, .jpg, or .jpeg extensions. It further narrows matches where the import invocation includes a -window argument targeting root, a pattern commonly associated with screenshot collection. The detection relies on auditd/execve telemetry capturing the import executable name and its command-line arguments.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md
- https://linux.die.net/man/1/import
- https://imagemagick.org/
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_screencapture_import.yml
author: Pawel Mazur, Huntrule Team
date: 2021-09-21
modified: 2022-10-09
tags:
- attack.collection
- attack.t1113
logsource:
product: linux
service: auditd
detection:
import:
type: EXECVE
a0: import
import_window_root:
a1: -window
a2: root
a3|endswith:
- .png
- .jpg
- .jpeg
import_no_window_root:
a1|endswith:
- .png
- .jpg
- .jpeg
condition: import and (import_window_root or import_no_window_root)
falsepositives:
- Legitimate use of screenshot utility
level: low
license: DRL-1.1
related:
- id: dbe4b9c5-c254-4258-9688-d6af0b7967fd
type: derived