Screen Capture with Xwd

Title: Screen Capture with Xwd
Status: test
Description:Detects adversary creating screen capture of a full with xwd. Highly recommended using rule on servers, due high usage of screenshot utilities on user workstations
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md#atomic-test-3---x-windows-capture
  -https://linux.die.net/man/1/xwd
Author: Pawel Mazur
Date: 2021-09-13
modified:2022-12-18
Tags:

• -'attack.collection'
• -'attack.t1113'

Logsource:

• product: linux
• service: auditd

Detection:
  selection:
    type: 'EXECVE'
    a0: 'xwd'
  xwd_root_window:
    a1: '-root'
    a2: '-out'
    a3|endswith: '.xwd'
  xwd_no_root_window:
    a1: '-out'
    a2|endswith: '.xwd'
  condition:selection and 1 of xwd_*
Falsepositives:
  -Legitimate use of screenshot utility
Level: low