T1513 Screen Capture

Mobile

Adversaries may use screen capture to collect additional information about a target device, such as applications running in the foreground, user data, credentials, or other sensitive information. Applications running in the background can capture screenshots or videos of another application running in the foreground by using the Android `MediaProjectionManager` (generally requires the device user to grant consent). Background applications can also use Android accessibility services to capture screen contents being displayed by a foreground application. An adversary with root access or Android Debug Bridge (adb) access could call the Android `screencap` or `screenrecord` commands.

01

platforms

Platforms this applies to.

Android
02

mitigations

ATT&CK mitigations that reduce this.

03

detected by (3)

Data components that detect this.

04

attack patterns (1)

CAPEC attack patterns that exploit this.

05

software (27)

Malware and tools associated with this.

06

source

Where this definition is published.

MITRE ATT&CK