capture-screenshot.yml

rule:
  meta:
    name: capture screenshot
    namespace: collection/screenshot
    author:
      - moritz.raabe@mandiant.com
      - "@_re_fox"
      - michael.hunhoff@mandiant.com
    scope: function
    att&ck:
      - Collection::Screen Capture [T1113]
    mbc:
      - Collection::Screen Capture::WinAPI [E1113.m01]
    examples:
      - BFB9B5391A13D0AFD787E87AB90F14F5:0x1314610A
      - 7204e3efc2434012e13ca939db0d0b02:0x414070
      - 50D5EE1CE2CA5E30C6B1019EE64EEEC2:0x406E07
  features:
    - or:
      - and:
        - or:
          - api: user32.GetWindowDC
          - api: user32.GetDC
          - and:
            - api: gdi32.CreateDC
            - string: "DISPLAY"
        - or:
          - api: gdi32.BitBlt
          - api: gdi32.GetDIBits
        - api: gdi32.CreateCompatibleDC
        - api: gdi32.CreateCompatibleBitmap
        - optional:
          - or:
            - api: user32.GetSystemMetrics = fetch screen dimensions
            - api: user32.GetDesktopWindow = get entire desktop
      - basic block:
        - and:
          - api: BitBlt
          - characteristic: tight loop