Linux screen capture via xwd writing .xwd output files

title: Linux screen capture via xwd writing .xwd output files
id: 30ef517a-704e-4172-8362-733c1bd8f4f9
status: test
description: This rule identifies execution of the xwd utility to capture the X11 root window or another window and writes the capture to a .xwd file. Screen capture capability can help an attacker collect visual information for reconnaissance or credential theft. Detection relies on Linux auditd telemetry capturing process execution arguments for xwd, including the presence of -out and an output filename ending in .xwd.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md#atomic-test-3---x-windows-capture
  - https://linux.die.net/man/1/xwd
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_screencaputre_xwd.yml
author: Pawel Mazur, Huntrule Team
date: 2021-09-13
modified: 2022-12-18
tags:
  - attack.collection
  - attack.t1113
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: EXECVE
    a0: xwd
  xwd_root_window:
    a1: -root
    a2: -out
    a3|endswith: .xwd
  xwd_no_root_window:
    a1: -out
    a2|endswith: .xwd
  condition: selection and 1 of xwd_*
falsepositives:
  - Legitimate use of screenshot utility
level: low
license: DRL-1.1
related:
  - id: e2f17c5d-b02a-442b-9052-6eb89c9fec9c
    type: derived