LoFP / legitimate user activity taking screenshots

Techniques

• t1113

Sample rules

Screen Capture - macOS

• source: sigma
• technicques:
  • t1113

Description

Detects attempts to use screencapture to collect macOS screenshots

Detection logic

condition: selection
selection:
  Image: /usr/sbin/screencapture