diff --git a/atomics/Indexes/Indexes-CSV/index.csv b/atomics/Indexes/Indexes-CSV/index.csv
index 99820e1c..df30d489 100644
--- a/atomics/Indexes/Indexes-CSV/index.csv
+++ b/atomics/Indexes/Indexes-CSV/index.csv
@@ -670,7 +670,7 @@ collection,T1114.001,Local Email Collection,1,Email Collection with PowerShell G
collection,T1113,Screen Capture,1,Screencapture,0f47ceb1-720f-4275-96b8-21f0562217ac,bash
collection,T1113,Screen Capture,2,Screencapture (silent),deb7d358-5fbd-4dc4-aecc-ee0054d2d9a4,bash
collection,T1113,Screen Capture,3,X Windows Capture,8206dd0c-faf6-4d74-ba13-7fbe13dce6ac,bash
-collection,T1113,Screen Capture,4,Import,9cd1cccb-91e4-4550-9139-e20a586fcea1,bash
+collection,T1113,Screen Capture,4,Capture Linux Desktop using Import Tool,9cd1cccb-91e4-4550-9139-e20a586fcea1,bash
exfiltration,T1020,Automated Exfiltration,1,IcedID Botnet HTTP PUT,9c780d3d-3a14-4278-8ee5-faaeb2ccfbe0,powershell
exfiltration,T1030,Data Transfer Size Limits,1,Data Transfer Size Limits,ab936c51-10f4-46ce-9144-e02137b2016a,sh
exfiltration,T1048,Exfiltration Over Alternative Protocol,1,Exfiltration Over Alternative Protocol - SSH,f6786cc8-beda-4915-a4d6-ac2f193bb988,sh
diff --git a/atomics/Indexes/Indexes-CSV/linux-index.csv b/atomics/Indexes/Indexes-CSV/linux-index.csv
index c3cbab9c..c01f0ea1 100644
--- a/atomics/Indexes/Indexes-CSV/linux-index.csv
+++ b/atomics/Indexes/Indexes-CSV/linux-index.csv
@@ -142,7 +142,7 @@ collection,T1560.001,Archive via Utility,7,Data Compressed - nix - tar Folder or
collection,T1560.001,Archive via Utility,8,Data Encrypted with zip and gpg symmetric,0286eb44-e7ce-41a0-b109-3da516e05a5f,sh
collection,T1074.001,Local Data Staging,2,Stage data from Discovery.sh,39ce0303-ae16-4b9e-bb5b-4f53e8262066,bash
collection,T1113,Screen Capture,3,X Windows Capture,8206dd0c-faf6-4d74-ba13-7fbe13dce6ac,bash
-collection,T1113,Screen Capture,4,Import,9cd1cccb-91e4-4550-9139-e20a586fcea1,bash
+collection,T1113,Screen Capture,4,Capture Linux Desktop using Import Tool,9cd1cccb-91e4-4550-9139-e20a586fcea1,bash
execution,T1053.001,At (Linux),1,At - Schedule a job,7266d898-ac82-4ec0-97c7-436075d0d08e,sh
execution,T1053.003,Cron,1,Cron - Replace crontab with referenced file,435057fb-74b1-410e-9403-d81baf194f75,bash
execution,T1053.003,Cron,2,Cron - Add script to cron folder,b7d42afa-9086-4c8a-b7b0-8ea3faa6ebb0,bash
diff --git a/atomics/Indexes/Indexes-Markdown/index.md b/atomics/Indexes/Indexes-Markdown/index.md
index d1a11c51..c3805661 100644
--- a/atomics/Indexes/Indexes-Markdown/index.md
+++ b/atomics/Indexes/Indexes-Markdown/index.md
@@ -1241,7 +1241,7 @@
- Atomic Test #1: Screencapture [macos]
- Atomic Test #2: Screencapture (silent) [macos]
- Atomic Test #3: X Windows Capture [linux]
- - Atomic Test #4: Import [linux]
+ - Atomic Test #4: Capture Linux Desktop using Import Tool [linux]
- T1213.002 Sharepoint [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- T1125 Video Capture [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- T1056.003 Web Portal Capture [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
diff --git a/atomics/Indexes/Indexes-Markdown/linux-index.md b/atomics/Indexes/Indexes-Markdown/linux-index.md
index 310e310e..509a0a9e 100644
--- a/atomics/Indexes/Indexes-Markdown/linux-index.md
+++ b/atomics/Indexes/Indexes-Markdown/linux-index.md
@@ -456,7 +456,7 @@
- T1114.002 Remote Email Collection [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- [T1113 Screen Capture](../../T1113/T1113.md)
- Atomic Test #3: X Windows Capture [linux]
- - Atomic Test #4: Import [linux]
+ - Atomic Test #4: Capture Linux Desktop using Import Tool [linux]
- T1213.002 Sharepoint [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
- T1056.003 Web Portal Capture [CONTRIBUTE A TEST](https://atomicredteam.io/contributing)
diff --git a/atomics/Indexes/index.yaml b/atomics/Indexes/index.yaml
index 0c589775..210f22c5 100644
--- a/atomics/Indexes/index.yaml
+++ b/atomics/Indexes/index.yaml
@@ -51299,9 +51299,10 @@ collection:
'
name: bash
- - name: Import
+ - name: Capture Linux Desktop using Import Tool
auto_generated_guid: 9cd1cccb-91e4-4550-9139-e20a586fcea1
- description: 'Use import command to collect a full desktop screenshot
+ description: 'Use import command from ImageMagick to collect a full desktop
+ screenshot
'
supported_platforms:
@@ -51311,6 +51312,16 @@ collection:
description: Output file path
type: Path
default: "/tmp/T1113_desktop.png"
+ dependencies:
+ - description: 'ImageMagick must be installed
+
+'
+ prereq_command: 'if import --version; then exit 0; else exit 1; fi
+
+'
+ get_prereq_command: 'sudo apt-get install imagemagick
+
+'
executor:
command: 'import -window root #{output_file}
diff --git a/atomics/T1113/T1113.md b/atomics/T1113/T1113.md
index 62aea3c3..b5ffb66a 100644
--- a/atomics/T1113/T1113.md
+++ b/atomics/T1113/T1113.md
@@ -11,7 +11,7 @@
- [Atomic Test #3 - X Windows Capture](#atomic-test-3---x-windows-capture)
-- [Atomic Test #4 - Import](#atomic-test-4---import)
+- [Atomic Test #4 - Capture Linux Desktop using Import Tool](#atomic-test-4---capture-linux-desktop-using-import-tool)
@@ -116,8 +116,8 @@ rm #{output_file}
-## Atomic Test #4 - Import
-Use import command to collect a full desktop screenshot
+## Atomic Test #4 - Capture Linux Desktop using Import Tool
+Use import command from ImageMagick to collect a full desktop screenshot
**Supported Platforms:** Linux
@@ -144,6 +144,18 @@ rm #{output_file}
+#### Dependencies: Run with `bash`!
+##### Description: ImageMagick must be installed
+##### Check Prereq Commands:
+```bash
+if import --version; then exit 0; else exit 1; fi
+```
+##### Get Prereq Commands:
+```bash
+sudo apt-get install imagemagick
+```
+
+