Screen Capture

let ScreenshotProcesses = dynamic([
  "scrot", "xwd", "import", "gnome-screenshot", "ksnapshot", "spectacle",
  "screencapture", "psr.exe", "snippingtool.exe", "snipingtool.exe",
  "screenshot.exe", "xrandr"
]);
let ScreenshotExtensions = dynamic([".png", ".jpg", ".jpeg", ".bmp", ".gif"]);
let SuspiciousParents = dynamic([
  "cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
  "mshta.exe", "regsvr32.exe", "rundll32.exe", "svchost.exe"
]);
// Branch 1: Known screenshot utility execution from suspicious parent or context
let ScreenshotUtilExec =
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ (ScreenshotProcesses)
    or ProcessCommandLine has_any ("CopyFromScreen", "GetDC", "BitBlt", "PrintWindow",
       "xwd -root", "scrot ", "screencapture ", "xrandr --screenshot")
| where InitiatingProcessFileName in~ (SuspiciousParents)
    or InitiatingProcessFileName !in~ ("explorer.exe", "userinit.exe", "svchost.exe",
       "winlogon.exe", "taskmgr.exe", "dllhost.exe")
| extend DetectionBranch = "ScreenshotUtilFromSuspiciousParent"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionBranch;
// Branch 2: PowerShell or scripting engine calling screenshot-related .NET APIs
let PSScreenshotAPI =
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe", "cscript.exe", "wscript.exe", "mshta.exe")
| where ProcessCommandLine has_any (
       "CopyFromScreen", "System.Drawing.Graphics", "System.Windows.Forms.Screen",
       "Graphics.CopyFromScreen", "[Drawing.Graphics]", "PrintWindow",
       "VK_SNAPSHOT", "keybd_event", "0x2C"
  )
| extend DetectionBranch = "ScriptingEngineScreenshotAPI"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionBranch;
// Branch 3: Suspicious screenshot file creation in staging locations by non-UI processes
let ScreenshotFileCreation =
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileCreated"
| where FolderPath has_any ("\\Temp\\", "\\AppData\\Local\\Temp\\", "\\ProgramData\\",
       "\\Users\\Public\\", "/tmp/", "/var/tmp/")
| where FileName endswith_any (ScreenshotExtensions)
| where InitiatingProcessFileName !in~ (
       "explorer.exe", "chrome.exe", "firefox.exe", "msedge.exe",
       "iexplore.exe", "outlook.exe", "teams.exe", "slack.exe",
       "zoom.exe", "mspaint.exe", "photoshop.exe", "gimp.exe"
  )
| where InitiatingProcessFileName !startswith "OneDrive"
| extend DetectionBranch = "SuspiciousScreenshotFileInTempPath"
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName,
         FileName, FolderPath, InitiatingProcessFileName,
         InitiatingProcessCommandLine, DetectionBranch;
union ScreenshotUtilExec, PSScreenshotAPI, ScreenshotFileCreation
| sort by Timestamp desc

| union
[
  search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  | eval Image_lower=lower(Image)
  | eval ParentImage_lower=lower(ParentImage)
  | eval is_screenshot_tool=if(
      match(Image_lower, "(scrot|xwd|screencapture|psr\.exe|snippingtool\.exe|snipingtool\.exe|screenshot\.exe)"),
      1, 0
    )
  | eval is_script_engine=if(
      match(Image_lower, "(powershell\.exe|pwsh\.exe|cscript\.exe|wscript\.exe|mshta\.exe)"),
      1, 0
    )
  | eval has_screenshot_api=if(
      is_script_engine=1 AND match(lower(CommandLine),
        "(copyfromscreen|system\.drawing\.graphics|system\.windows\.forms\.screen|printwindow|vk_snapshot|keybd_event|0x2c)"),
      1, 0
    )
  | eval suspicious_parent=if(
      match(ParentImage_lower,
        "(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|regsvr32\.exe|rundll32\.exe)"),
      1, 0
    )
  | eval detection_branch=case(
      is_screenshot_tool=1 AND suspicious_parent=1, "ScreenshotUtilFromSuspiciousParent",
      has_screenshot_api=1, "ScriptingEngineScreenshotAPI",
      true(), null()
    )
  | where isnotnull(detection_branch)
  | eval SuspicionScore=is_screenshot_tool + has_screenshot_api + suspicious_parent
  | table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine,
          detection_branch, SuspicionScore
],
[
  search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
  | eval TargetFilename_lower=lower(TargetFilename)
  | eval Image_lower=lower(Image)
  | eval is_image_extension=if(
      match(TargetFilename_lower, "\.(png|jpg|jpeg|bmp|gif)$"),
      1, 0
    )
  | eval is_staging_path=if(
      match(TargetFilename_lower,
        "(\\\\temp\\\\|\\\\appdata\\\\local\\\\temp\\\\|\\\\programdata\\\\|\\\\users\\\\public\\\\)"),
      1, 0
    )
  | eval is_ui_process=if(
      match(Image_lower,
        "(explorer\.exe|chrome\.exe|firefox\.exe|msedge\.exe|iexplore\.exe|outlook\.exe|teams\.exe|slack\.exe|zoom\.exe|mspaint\.exe|onedrive\.exe|snagit\.exe)"),
      1, 0
    )
  | where is_image_extension=1 AND is_staging_path=1 AND is_ui_process=0
  | eval detection_branch="SuspiciousScreenshotFileInTempPath"
  | eval SuspicionScore=2
  | table _time, host, User, Image, TargetFilename, detection_branch, SuspicionScore
]
| sort - _time

any where
(
  /* Branch 1: Known screenshot utility executed from suspicious parent */
  (
    event.category == "process" and event.type == "start" and
    (
      process.name in~ ("scrot", "xwd", "import", "gnome-screenshot", "ksnapshot", "spectacle",
        "screencapture", "psr.exe", "snippingtool.exe", "snipingtool.exe", "screenshot.exe", "xrandr") or
      process.command_line : ("*CopyFromScreen*", "*GetDC*", "*BitBlt*", "*PrintWindow*",
        "*xwd -root*", "*scrot *", "*screencapture *", "*xrandr --screenshot*")
    ) and
    (
      process.parent.name in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
        "mshta.exe", "regsvr32.exe", "rundll32.exe", "svchost.exe") or
      not process.parent.name in~ ("explorer.exe", "userinit.exe", "svchost.exe", "winlogon.exe",
        "taskmgr.exe", "dllhost.exe")
    )
  ) or
  /* Branch 2: Scripting engine invoking screenshot-related .NET or Win32 APIs */
  (
    event.category == "process" and event.type == "start" and
    process.name in~ ("powershell.exe", "pwsh.exe", "cscript.exe", "wscript.exe", "mshta.exe") and
    process.command_line : ("*CopyFromScreen*", "*System.Drawing.Graphics*",
      "*System.Windows.Forms.Screen*", "*Graphics.CopyFromScreen*", "*PrintWindow*",
      "*VK_SNAPSHOT*", "*keybd_event*", "*0x2C*")
  ) or
  /* Branch 3: Image file created in staging/temp paths by non-UI processes */
  (
    event.category == "file" and event.type == "creation" and
    file.path : ("*/tmp/*", "*/var/tmp/*", "*\\Temp\\*", "*\\AppData\\Local\\Temp\\*",
      "*\\ProgramData\\*", "*\\Users\\Public\\*") and
    (
      file.name : "*.png" or file.name : "*.jpg" or file.name : "*.jpeg" or
      file.name : "*.bmp" or file.name : "*.gif"
    ) and
    not process.name in~ ("explorer.exe", "chrome.exe", "firefox.exe", "msedge.exe",
      "iexplore.exe", "outlook.exe", "teams.exe", "slack.exe", "zoom.exe",
      "mspaint.exe", "photoshop.exe", "gimp.exe") and
    not process.name : "OneDrive*"
  )
)

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  LOGSOURCENAME(logsourceid) AS log_source,
  sourceip AS host_ip,
  username,
  "Process Name" AS process_name,
  "Command" AS command_line,
  "Parent Process Name" AS parent_process_name,
  CASE
    WHEN LOWER("Process Name") MATCHES
        '(scrot|xwd|screencapture|psr\.exe|snippingtool\.exe|snipingtool\.exe|screenshot\.exe|xrandr)'
      AND LOWER("Parent Process Name") MATCHES
        '(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|regsvr32\.exe|rundll32\.exe)'
    THEN 'ScreenshotUtilFromSuspiciousParent'
    WHEN LOWER("Process Name") MATCHES
        '(powershell\.exe|pwsh\.exe|cscript\.exe|wscript\.exe|mshta\.exe)'
      AND LOWER("Command") MATCHES
        '(copyfromscreen|system\.drawing\.graphics|system\.windows\.forms\.screen|printwindow|vk_snapshot|keybd_event|0x2c)'
    THEN 'ScriptingEngineScreenshotAPI'
    ELSE 'Unknown'
  END AS detection_branch
FROM events
WHERE devicetime > NOW() - 86400000
  AND LOGSOURCETYPEID IN (12, 119, 341, 352)
  AND (
    (
      LOWER("Process Name") MATCHES
        '(scrot|xwd|screencapture|psr\.exe|snippingtool\.exe|snipingtool\.exe|screenshot\.exe|xrandr)'
      AND LOWER("Parent Process Name") MATCHES
        '(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|regsvr32\.exe|rundll32\.exe)'
    ) OR (
      LOWER("Process Name") MATCHES
        '(powershell\.exe|pwsh\.exe|cscript\.exe|wscript\.exe|mshta\.exe)'
      AND LOWER("Command") MATCHES
        '(copyfromscreen|system\.drawing\.graphics|system\.windows\.forms\.screen|printwindow|vk_snapshot|keybd_event|0x2c)'
    )
  )
ORDER BY devicetime DESC

(_sourceCategory=windows/sysmon OR _sourceCategory=endpoint/windows/sysmon)
| where EventID in ("1", "11")
| eval image_lower = toLowerCase(Image)
| eval parent_lower = toLowerCase(ParentImage)
| eval cmdline_lower = toLowerCase(CommandLine)
| eval target_lower = toLowerCase(TargetFilename)
// Branch 1: Screenshot tool detection (EventID=1)
| eval is_screenshot_tool = if(
    EventID = "1" and
    matches(image_lower, "scrot|xwd|gnome-screenshot|ksnapshot|spectacle|screencapture|psr\\.exe|snippingtool\\.exe|snipingtool\\.exe|screenshot\\.exe|xrandr"),
    1, 0)
// Branch 2a: Scripting engine process
| eval is_script_engine = if(
    EventID = "1" and
    matches(image_lower, "powershell\\.exe|pwsh\\.exe|cscript\\.exe|wscript\\.exe|mshta\\.exe"),
    1, 0)
// Branch 2b: Screenshot API in command line
| eval has_screenshot_api = if(
    is_script_engine = 1 and
    matches(cmdline_lower,
      "copyfromscreen|system\\.drawing\\.graphics|system\\.windows\\.forms\\.screen|printwindow|vk_snapshot|keybd_event|0x2c"),
    1, 0)
// Suspicious parent process check
| eval suspicious_parent = if(
    matches(parent_lower,
      "cmd\\.exe|powershell\\.exe|pwsh\\.exe|wscript\\.exe|cscript\\.exe|mshta\\.exe|regsvr32\\.exe|rundll32\\.exe"),
    1, 0)
// Branch 3: Suspicious image file creation (EventID=11)
| eval is_image_ext = if(
    EventID = "11" and
    matches(target_lower, "\\.(png|jpg|jpeg|bmp|gif)$"),
    1, 0)
| eval is_staging_path = if(
    EventID = "11" and
    matches(target_lower,
      "\\\\temp\\\\|\\\\appdata\\\\local\\\\temp\\\\|\\\\programdata\\\\|\\\\users\\\\public\\\\"),
    1, 0)
| eval is_ui_process = if(
    matches(image_lower,
      "explorer\\.exe|chrome\\.exe|firefox\\.exe|msedge\\.exe|iexplore\\.exe|outlook\\.exe|teams\\.exe|slack\\.exe|zoom\\.exe|mspaint\\.exe|onedrive"),
    1, 0)
// Assign detection branch
| eval detection_branch = if(
    is_screenshot_tool = 1 and suspicious_parent = 1,
    "ScreenshotUtilFromSuspiciousParent",
    if(has_screenshot_api = 1,
    "ScriptingEngineScreenshotAPI",
    if(is_image_ext = 1 and is_staging_path = 1 and is_ui_process = 0,
    "SuspiciousScreenshotFileInTempPath",
    null)))
| where !isnull(detection_branch)
| eval suspicion_score = is_screenshot_tool + has_screenshot_api + suspicious_parent + is_staging_path
| fields _messageTime, Computer, User, Image, CommandLine, ParentImage, TargetFilename,
    detection_branch, suspicion_score
| sort by _messageTime desc

rule t1113_screen_capture_process {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects MITRE ATT&CK T1113 screen capture via known utilities from suspicious parents or scripting engines using screenshot APIs"
    mitre_attack_technique = "T1113"
    mitre_attack_tactic = "Collection"
    severity = "MEDIUM"
    confidence = "MEDIUM"
    version = "1.0"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      // Branch 1: Known screenshot tool launched from suspicious scripting parent
      (
        (
          re.regex($e.target.process.file.full_path,
            `(?i)(scrot|xwd|gnome-screenshot|ksnapshot|spectacle|screencapture|psr\.exe|snippingtool\.exe|snipingtool\.exe|screenshot\.exe|xrandr)`) or
          re.regex($e.target.process.command_line,
            `(?i)(CopyFromScreen|GetDC|BitBlt|PrintWindow|xwd\s+-root|scrot\s+|screencapture\s+|xrandr\s+--screenshot)`)
        ) and
        re.regex($e.principal.process.file.full_path,
          `(?i)(cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|regsvr32\.exe|rundll32\.exe|svchost\.exe)`)
      ) or
      // Branch 2: Scripting engine invoking screenshot .NET or Win32 APIs
      (
        re.regex($e.target.process.file.full_path,
          `(?i)(powershell\.exe|pwsh\.exe|cscript\.exe|wscript\.exe|mshta\.exe)`) and
        re.regex($e.target.process.command_line,
          `(?i)(CopyFromScreen|System\.Drawing\.Graphics|System\.Windows\.Forms\.Screen|Graphics\.CopyFromScreen|PrintWindow|VK_SNAPSHOT|keybd_event|0x2C)`)
      )
    )

  condition:
    $e
}

rule t1113_screen_capture_file_staging {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects suspicious image file creation in temp/staging paths by non-UI processes, indicating screenshot staging for exfiltration (T1113)"
    mitre_attack_technique = "T1113"
    mitre_attack_tactic = "Collection"
    severity = "MEDIUM"
    confidence = "MEDIUM"
    version = "1.0"

  events:
    $e.metadata.event_type = "FILE_CREATION"
    re.regex($e.target.file.full_path, `(?i)\.(png|jpg|jpeg|bmp|gif)$`)
    re.regex($e.target.file.full_path,
      `(?i)(\\Temp\\|\\AppData\\Local\\Temp\\|\\ProgramData\\|\\Users\\Public\\|/tmp/|/var/tmp/)`)
    not re.regex($e.principal.process.file.full_path,
      `(?i)(explorer\.exe|chrome\.exe|firefox\.exe|msedge\.exe|iexplore\.exe|outlook\.exe|teams\.exe|slack\.exe|zoom\.exe|mspaint\.exe|photoshop\.exe|gimp\.exe|OneDrive)`)

  condition:
    $e
}

// Branches 1 & 2: Screenshot utility or scripting engine API usage via process events
#event_simpleName in ("ProcessRollup2", "SyntheticProcessRollup2")
| eval FileName_lower = lower(FileName)
| eval ParentBaseFileName_lower = lower(ParentBaseFileName)
| eval CommandLine_lower = lower(CommandLine)
| eval is_screenshot_tool = if(
    FileName_lower = /scrot|xwd|gnome-screenshot|ksnapshot|spectacle|screencapture|psr\.exe|snippingtool\.exe|snipingtool\.exe|screenshot\.exe|xrandr/,
    1, 0)
| eval is_script_engine = if(
    FileName_lower = /powershell\.exe|pwsh\.exe|cscript\.exe|wscript\.exe|mshta\.exe/,
    1, 0)
| eval has_screenshot_api = if(
    is_script_engine = 1 and CommandLine_lower = /copyfromscreen|system\.drawing\.graphics|system\.windows\.forms\.screen|printwindow|vk_snapshot|keybd_event|0x2c/,
    1, 0)
| eval suspicious_parent = if(
    ParentBaseFileName_lower = /cmd\.exe|powershell\.exe|pwsh\.exe|wscript\.exe|cscript\.exe|mshta\.exe|regsvr32\.exe|rundll32\.exe/,
    1, 0)
| eval DetectionBranch = case(
    is_screenshot_tool = 1 and suspicious_parent = 1,
      "ScreenshotUtilFromSuspiciousParent",
    has_screenshot_api = 1,
      "ScriptingEngineScreenshotAPI",
    true(),
      null())
| where DetectionBranch != null
| eval SuspicionScore = is_screenshot_tool + has_screenshot_api + suspicious_parent
| select([
    @timestamp, ComputerName, UserName, UserSid, FileName, CommandLine,
    ParentBaseFileName, ParentCommandLine, DetectionBranch, SuspicionScore])
| sort(field=@timestamp, order=desc)