Screen capture invoked from the command line

Siemphony@siemphonymediumT1113unverified

Screen capture on Windows is normally reached either through the GDI and .NET drawing APIs, where a script names CopyFromScreen, BitBlt or CopyPixelOperation inline, or through a small set of built in and portable utilities invoked with capture switches. This rule matches process creation where the command line carries one of those API or utility markers, because the command line is the only place in Sysmon EventID 1 where the intent to grab the screen is actually visible. Scripts that call the same APIs from a file on disk rather than an inline one liner will not appear here, so this covers the interactive and staged half of the analytic rather than all of it. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0346, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (ProcessCommandLine contains "CopyFromScreen" or ProcessCommandLine contains "CopyPixelOperation" or ProcessCommandLine contains "System.Drawing.Bitmap" or ProcessCommandLine contains "Drawing.Graphics]::FromImage" or ProcessCommandLine contains "BitBlt" or ProcessCommandLine contains "PrintWindow" or ProcessCommandLine contains "savescreenshot" or ProcessCommandLine contains "psr.exe /start" or ProcessCommandLine contains "Get-Screenshot")

Splunk · SPL

Run this as a search.

index=* (CommandLine="*CopyFromScreen*" OR CommandLine="*CopyPixelOperation*" OR CommandLine="*System.Drawing.Bitmap*" OR CommandLine="*Drawing.Graphics]::FromImage*" OR CommandLine="*BitBlt*" OR CommandLine="*PrintWindow*" OR CommandLine="*savescreenshot*" OR CommandLine="*psr.exe /start*" OR CommandLine="*Get-Screenshot*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.command_line) LIKE "*copyfromscreen*" OR TO_LOWER(process.command_line) LIKE "*copypixeloperation*" OR TO_LOWER(process.command_line) LIKE "*system.drawing.bitmap*" OR TO_LOWER(process.command_line) LIKE "*drawing.graphics]::fromimage*" OR TO_LOWER(process.command_line) LIKE "*bitblt*" OR TO_LOWER(process.command_line) LIKE "*printwindow*" OR TO_LOWER(process.command_line) LIKE "*savescreenshot*" OR TO_LOWER(process.command_line) LIKE "*psr.exe /start*" OR TO_LOWER(process.command_line) LIKE "*get-screenshot*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(CopyFromScreen|CopyPixelOperation|System\.Drawing\.Bitmap|Drawing\.Graphics\]::FromImage|BitBlt|PrintWindow|savescreenshot|psr\.exe /start|Get-Screenshot)</field>    <description>Screen capture invoked from the command line</description>    <mitre>      <id>T1113</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: data_staging_exfil
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: a1f413cf-6abd-4e92-92d2-bd38545a98a4

ATT&CKT1113

T1113Screen Capture

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondata staging exfil

data staging exfilAI draft — unreviewed

01 · What this rule detects

Windows emits no "a screenshot was taken" event. There is no API-call log, no kernel notification, nothing in the Security channel. So this rule — Screen capture invoked from the command line — settles for the one place where the intent is written down in plain text: the CommandLine field of a process-creation event. It matches nine markers, in two families. Six are .NET and GDI names an operator types inline (CopyFromScreen, CopyPixelOperation, System.Drawing.Bitmap, Drawing.Graphics]::FromImage, BitBlt, PrintWindow); three are utilities invoked with a capture switch (savescreenshot, psr.exe /start, Get-Screenshot).

02 · Telemetry you need

Sysmon EventID 1 with CommandLine populated — the process_creation /
If you substitute Security 4688, "Include command line in process creation
AN0980 also offers a Module Load leg (Sysmon EventID 7), ignored here.

03 · How the logic works

One selection, one field, nine contains terms, condition: selection. The flatness is the point, and each choice is defensible: Why `CommandLine` and not `Image`. CopyFromScreen is a .NET method, not a program. The process running it is powershell.exe, a signed scripting host, or an implant with a name you have never seen. Selecting on process name finds only the capture tools you already knew about; selecting on the API name finds the behaviour regardless of what hosts it. contains rather than endswith follows from that — these are code fragments in the middle of a one-liner, not path suffixes. Why `psr.exe /start` is one string. Problem Steps Recorder is a signed Microsoft binary in System32; its presence is meaningless and the /start switch is the intent. Pairing them keeps a benign mention of psr.exe from matching. What it cannot see, and why that matters. The API name only appears on the command line when the code is inline. powershell.exe -File C:\ProgramData\collect.ps1 reveals nothing, and a base64 -enc payload hides the marker inside the encoding. The rule's own description says so: it covers the interactive and staged half of AN0980, not all of it.

04 · Common false positives

System.Drawing.Bitmap is by far the broadest term — it is a type name, and
BitBlt and PrintWindow show up in P/Invoke signature declarations. A
RPA bots and UI regression harnesses call CopyFromScreen on a fixed
Helpdesk and IT documentation workflows capture the desktop on request.

05 · Detection maturity

tier_1: , and honestly so. Authored from MITRE's scaffold — MITRE ships prose and tuning knobs, no query logic — and never run against a single log line. Nothing here is evidence that it fires, or that it fires on the right things.
tier_2: run it read-only over your own process-creation history, see how much of the volume is `System.Drawing.Bitmap` in report tooling, and turn the survivors into a parent-process filter.
tier_3: ** join it to the file_event image-write leg behind MITRE's ImageExtension knob and apply a TimeWindow, so you alert on a capture that produced a file rather than on a string in a command line.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE's `ParentProcessName` knob is the first lever: in a fleet where
MITRE's `TimeWindow` knob separates a scheduled test harness from
MITRE's `ImageExtension` knob (.bmp, .png writes) belongs to a
Split the nine terms by confidence. psr.exe /start and Get-Screenshot

Declared by the author

Helpdesk and IT documentation workflows that capture the desktop on request, typically launched from the interactive shell. MITRE names ParentProcessName as the tuning knob here, because an environment where explorer.exe is the normal parent can filter on it and one where an automation agent is the normal parent cannot.
Robotic process automation and UI regression test harnesses that call CopyFromScreen or BitBlt on a fixed interval. MITRE's TimeWindow knob is what separates a scheduled test harness from interval based collection, and this rule deliberately does not encode a threshold.
Image processing and report generation scripts that instantiate System.Drawing.Bitmap without ever touching the screen, which match the broadest of the terms above on the type name alone.
Installer and packaging tooling that shells out to a portable screenshot utility to record a build artefact.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1113, evaluated against their process_creation events.

Share this rule

/u/siemphony/a1f413cf-6abd-4e92-92d2-bd38545a98a4

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Screen capture invoked from the command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it