macOS Process Creation: screencapture Used for Screenshot Collection

Identifies macOS instances where /usr/sbin/screencapture is executed to collect screenshots.

FreeUnreviewedSigmalowv1

macos-process-creation-screencapture-used-for-screenshot-collection-0877ed01

title: "macOS Process Creation: screencapture Used for Screenshot Collection"
id: 1df97bca-44ed-4459-b624-231e1dc99b88
status: test
description: This rule flags process executions of /usr/sbin/screencapture on macOS, indicating an attempt to capture on-screen content. Attackers and malicious insiders may use screenshot collection to observe sensitive data before exfiltration. The detection relies on process creation telemetry that records the Image path of the launched executable.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md
  - https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/python/collection/osx/screenshot.py
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_screencapture.yml
author: remotephone, oscd.community, Huntrule Team
date: 2020-10-13
modified: 2021-11-27
tags:
  - attack.collection
  - attack.t1113
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    Image: /usr/sbin/screencapture
  condition: selection
falsepositives:
  - Legitimate user activity taking screenshots
level: low
license: DRL-1.1
related:
  - id: 0877ed01-da46-4c49-8476-d49cdd80dfa7
    type: derived

What it detects

This rule flags process executions of /usr/sbin/screencapture on macOS, indicating an attempt to capture on-screen content. Attackers and malicious insiders may use screenshot collection to observe sensitive data before exfiltration. The detection relies on process creation telemetry that records the Image path of the launched executable.

Known false positives

Legitimate user activity taking screenshots

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.