Linux screen capture using xwd saving a .xwd file
Flags xwd screen capture executions that write captured output to a .xwd file on Linux.
- Product
- linux
- Service
- auditd
- Author
- Pawel Mazur (SigmaHQ), DRL 1.1
- Published
- 2021-09-13
- Updated
- 2026-07-31
ATT&CK techniques
CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies executions of the xwd utility used to capture the root (full screen) window and write the output to a file ending in .xwd. Screen capture is a common capability for collecting visual information from a compromised system, which can help attackers with reconnaissance or further targeting. The detection relies on Linux auditd EXECVE telemetry showing the xwd command-line arguments (-root or -out) and the presence of a .xwd output file.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md#atomic-test-3---x-windows-capture
- linux.die.nethttps://linux.die.net/man/1/xwd
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_screencaputre_xwd.yml
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux screen capture using xwd saving a .xwd file
id: 30ef517a-704e-4172-8362-733c1bd8f4f9
status: test
description: This rule identifies executions of the xwd utility used to capture the root (full screen) window and write the output to a file ending in .xwd. Screen capture is a common capability for collecting visual information from a compromised system, which can help attackers with reconnaissance or further targeting. The detection relies on Linux auditd EXECVE telemetry showing the xwd command-line arguments (-root or -out) and the presence of a .xwd output file.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md#atomic-test-3---x-windows-capture
- https://linux.die.net/man/1/xwd
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_screencaputre_xwd.yml
author: Pawel Mazur, Huntrule Team
date: 2021-09-13
modified: 2022-12-18
tags:
- attack.collection
- attack.t1113
logsource:
product: linux
service: auditd
detection:
selection:
type: EXECVE
a0: xwd
xwd_root_window:
a1: -root
a2: -out
a3|endswith: .xwd
xwd_no_root_window:
a1: -out
a2|endswith: .xwd
condition: selection and 1 of xwd_*
falsepositives:
- Legitimate use of screenshot utility
level: low
license: DRL-1.1
related:
- id: e2f17c5d-b02a-442b-9052-6eb89c9fec9c
type: derived