huntrule

Linux Import Tool Image Capture via execve with -window root and .png/.jpg output

Flags Linux ImageMagick import executions likely used for desktop screenshot capture to PNG/JPG outputs or root window.

FreeReviewedSigma · Low · v3
Product
linux
Service
auditd
Author
Pawel Mazur (SigmaHQ), DRL 1.1
Published
2021-09-21
Updated
2026-07-31
AnalysisDetection
title: Linux Import Tool Image Capture via execve with -window root and .png/.jpg output
id: 0398b936-292f-40ce-82d2-5dfffb42eca4
status: test
description: This rule identifies Linux processes executing the ImageMagick import command to capture a desktop or window and write output files with .png, .jpg, or .jpeg extensions. It further narrows matches where the import invocation includes a -window argument targeting root, a pattern commonly associated with screenshot collection. The detection relies on auditd/execve telemetry capturing the import executable name and its command-line arguments.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md
  - https://linux.die.net/man/1/import
  - https://imagemagick.org/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_screencapture_import.yml
author: Pawel Mazur, Huntrule Team
date: 2021-09-21
modified: 2022-10-09
tags:
  - attack.collection
  - attack.t1113
logsource:
  product: linux
  service: auditd
detection:
  import:
    type: EXECVE
    a0: import
  import_window_root:
    a1: -window
    a2: root
    a3|endswith:
      - .png
      - .jpg
      - .jpeg
  import_no_window_root:
    a1|endswith:
      - .png
      - .jpg
      - .jpeg
  condition: import and (import_window_root or import_no_window_root)
falsepositives:
  - Legitimate use of screenshot utility
level: low
license: DRL-1.1
related:
  - id: dbe4b9c5-c254-4258-9688-d6af0b7967fd
    type: derived