Detectionlowtest

Screen Capture - macOS

Detects attempts to use screencapture to collect macOS screenshots

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

remotephone, oscd.communityCreated Tue Oct 13Updated Sat Nov 270877ed01-da46-4c49-8476-d49cdd80dfa7macos

Log Source

macOSProcess Creation

ProductmacOS← raw: macos

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        Image: '/usr/sbin/screencapture'
    condition: selection

False Positives

Legitimate user activity taking screenshots

References

MITRE ATT&CK

Tactics

Techniques

Rule Metadata

Rule ID

0877ed01-da46-4c49-8476-d49cdd80dfa7

Status

test

Level

low

Type

Detection

Created

Tue Oct 13

Modified

Sat Nov 27

Author

Path

rules/macos/process_creation/proc_creation_macos_screencapture.yml

Raw Tags

attack.collectionattack.t1113