T1113 · Screen Capture

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1113 · Screen Capture · Sunturai

attack-patternenterprise-attackT1113

Screen Capture

attack-pattern--0259baeb-9f63-4c69-bf10-eb038c390688

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.(Citation: CopyFromScreen .NET) (Citation: Antiquated Mac Malware)

Created: May 31, 2017, 9:31 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

20 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Potential Remote Desktop Shadowing Activity	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
PowerShell Suspicious Script with Screenshot Capabilities	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Linux Video Recording or Screenshot Activity Detected	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
CYFIRMA - Medium severity File Hash Indicators with Block Action and Malware	Medium	Microsoft Sentinel analytics	Aug 29, 2026	MIT License
CYFIRMA - High severity File Hash Indicators with Block Action and Malware	High	Microsoft Sentinel analytics	Aug 29, 2026	MIT License
Powershell Empire Cmdlets Executed in Command Line	Medium	Microsoft Sentinel analytics	Aug 29, 2026	MIT License
Windows Screen Capture Via Powershell	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Screen Capture in TEMP folder	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Suspicious WAV file in Appdata Folder	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Suspicious Image Creation In Appdata Folder	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Remcos RAT File Creation in Remcos Folder	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Windows Recall Feature Enabled - Registry	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Periodic Backup For System Registry Hives Enabled	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Windows Recall Feature Enabled Via Reg.EXE	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Screen Capture Activity Via Psr.EXE	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Windows Screen Capture with CopyFromScreen	Medium	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Screen Capture - macOS	Low	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Screen Capture with Xwd	Low	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1
Screen Capture with Import Tool	Low	SigmaHQ	Aug 26, 2026	Detection Rule License 1.1

Showing 20 of 20

Filter in the catalogue

External references

mitre-attackT1113Open reference

CopyFromScreen .NETOpen reference

Antiquated Mac MalwareOpen reference

Platforms

LinuxmacOSWindows

Kill chain phases

collection

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object