Linux screen capture using xwd saving a .xwd file

title: Linux screen capture using xwd saving a .xwd file
id: 30ef517a-704e-4172-8362-733c1bd8f4f9
status: test
description: This rule identifies executions of the xwd utility used to capture the root (full screen) window and write the output to a file ending in .xwd. Screen capture is a common capability for collecting visual information from a compromised system, which can help attackers with reconnaissance or further targeting. The detection relies on Linux auditd EXECVE telemetry showing the xwd command-line arguments (-root or -out) and the presence of a .xwd output file.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md#atomic-test-3---x-windows-capture
  - https://linux.die.net/man/1/xwd
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_screencaputre_xwd.yml
author: Pawel Mazur, Huntrule Team
date: 2021-09-13
modified: 2022-12-18
tags:
  - attack.collection
  - attack.t1113
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: EXECVE
    a0: xwd
  xwd_root_window:
    a1: -root
    a2: -out
    a3|endswith: .xwd
  xwd_no_root_window:
    a1: -out
    a2|endswith: .xwd
  condition: selection and 1 of xwd_*
falsepositives:
  - Legitimate use of screenshot utility
level: low
license: DRL-1.1
related:
  - id: e2f17c5d-b02a-442b-9052-6eb89c9fec9c
    type: derived