CmdID

CmdID / Commands

screencapture

Utility to take screenshots and screen recordings. tldr-pages

On macOS 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Take a screenshot and save it to a file

screencapture path/to/file.pngIdentify

Take a screenshot including the mouse cursor

screencapture -C path/to/file.pngIdentify

Take a screenshot and open it in Preview, instead of saving

screencapture -PIdentify

Take a screenshot of a selected rectangular area

screencapture -i path/to/file.pngIdentify

Take a screenshot after a delay

screencapture -T seconds path/to/file.pngIdentify

Make a screen recording and save it to a file

screencapture -v path/to/file.mp4Identify

What detects it

Sigma process creation rules that name screencapture
lowScreen Capture - macOSremotephone, oscd.community