Screen Capture
Where this stands
A Sigma rule exists for this technique in the corpus.
A detection for this technique exists in the corpus. Log in to read it.
When a detection for this fires
Collection and exfiltrationData being gathered or moved. This is where a security incident becomes a disclosure obligation.What the technique is
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0980
Unusual use of screen capture APIs (e.g., CopyFromScreen) or command-line tools to write image files to disk.
- AN0981
Invocation of built-in commands like screencapture or use of undocumented APIs from suspicious parent processes.
- AN0982
Use of tools like xwd or import to generate screenshots, especially under non-GUI parent processes.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.