X can do screen shots of the entire desktop. I'd like to detect these calls as they're made, but through something like ebpf or sysdig, rather than patching the calls at the server level. How can I do this and is there a program that can do this as well?