Elastic Defend high stable eql

Suspicious Image Creation via ScreenCapture

Detects when the ScreenCapture binary executes and creates an image in a suspicious location like tmp or the shared directory. Malware has used the ScreenCapture binary to collect images of victim systems and exfiltrate them via C2.

View Source

Detection Logic

sequence by process.entity_id with maxspan=10s
[process where event.type == "start" and event.action == "exec" and process.name == "screencapture" and
  not process.command_line == "screencapture --help" and
  not process.parent.executable like ("/System/Library/CoreServices/SystemUIServer.app/Contents/MacOS/SystemUIServer",
                                      "/System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow") and
  not process.Ext.effective_parent.executable like ("/System/Library/CoreServices/SystemUIServer.app/Contents/MacOS/SystemUIServer",
                                                    "/System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow",
                                                    "/Applications/Visual Studio Code.app/*",
                                                    "/Applications/Cursor.app/*",
                                                    "/Applications/Claude.app/*",
                                                    "/Applications/Ghostty.app/*",
                                                    "/Applications/IntelliJ IDEA.app/*",
                                                    "/Users/*/Applications/Codex.app/*",
                                                    "/Users/*/Library/Application Support/Claude/claude-code/*/claude.app/*",
                                                    "/Applications/Codex.app/*",
                                                    "/private/var/folders/*/AppTranslocation/*/Visual Studio Code.app/*",
                                                    "/Users/*/.local/bin/uv",
                                                    "/Applications/Warp.app/*",
                                                    "/Applications/Obsidian.app/*",
                                                    "/Applications/Tabby.app/*",
                                                    "/Applications/Android Studio.app/Contents/MacOS/studio",
                                                    "/Applications/Zed.app/Contents/MacOS/zed",
                                                    "/Applications/WebStorm.app/*")]
[file where event.action == "modification" and file.path like ("/Users/Shared/*", "/tmp/*", "/private/tmp/*")]

Field Validations

Loading…

Comments (0)

Loading comments...