T1113 Screen Capture
EnterpriseAdversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or <code>screencapture</code>.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
detected by (2)
Data components that detect this.
countered by (D3FEND)
D3FEND countermeasures that counter this.
attack patterns (1)
CAPEC attack patterns that exploit this.
groups (19)
Threat groups associated with this.
software (152)
Malware and tools associated with this.
campaigns (1)
Campaigns that use this.
Detected by (Sigma) (10)
Sigma detection rules related to this.
source
Where this definition is published.