macOS Screen Capture via /usr/sbin/screencapture Process Execution

Identifies macOS instances where /usr/sbin/screencapture is executed to collect screenshots.

FreeReviewedSigma · Low · v2

Product: macos
Category: process_creation
Author: remotephone, oscd.community (SigmaHQ), DRL 1.1
Published: 2020-10-13
Updated: 2026-07-31

ATT&CK techniques

Collection

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
- T1113Screen Capture
C2
Exfiltration
Impact

What it detects

This rule flags process executions of /usr/sbin/screencapture on macOS, indicating an attempt to collect screenshots from the local system. Attackers may use built-in screenshot utilities to capture sensitive information for later exfiltration or analysis. The detection relies on process creation telemetry that records the executed Image path.

Reporting behind it

Related detections9 linkedT1113 — drag to rearrange

Suspicious Keylog and Screenshot Files in windows-cache Directory (OtterCookie)

Suspicious RDP Shadow Session Started - Native (via rdp)

Malicious RDP Shadow Session Configuration Enabled - Registry (via registry_event)

Suspicious GoGRPC Screen Capture Log File Creation (via file_event)

Suspicious Screen Capture via PowerShell Graphics API (via process_creation)

Malicious RDP Shadow Session Started - Command (via process_creation)

Windows Registry: EnablePeriodicBackup value set for periodic system hive backups

Windows Recall Enabled by Deleting DisableAIDataAnalysis Registry Value

Windows Recall Enabled by Registry: DisableAIDataAnalysis Set to 0 (Windows)

macOS Screen Capture via /usr/sbin/screencapture Process Execution

Pivot detection · T1113 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

macos-process-creation-screencapture-used-for-screenshot-collection-0877ed01

title: macOS Screen Capture via /usr/sbin/screencapture Process Execution
id: 1df97bca-44ed-4459-b624-231e1dc99b88
status: test
description: This rule flags process executions of /usr/sbin/screencapture on macOS, indicating an attempt to collect screenshots from the local system. Attackers may use built-in screenshot utilities to capture sensitive information for later exfiltration or analysis. The detection relies on process creation telemetry that records the executed Image path.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md
  - https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/python/collection/osx/screenshot.py
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_screencapture.yml
author: remotephone, oscd.community, Huntrule Team
date: 2020-10-13
modified: 2021-11-27
tags:
  - attack.collection
  - attack.t1113
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    Image: /usr/sbin/screencapture
  condition: selection
falsepositives:
  - Legitimate user activity taking screenshots
level: low
license: DRL-1.1
related:
  - id: 0877ed01-da46-4c49-8476-d49cdd80dfa7
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL