T1113Collection
Screen Capture
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
10 Sigma rules tagged T1113Screen CaptureT111310 general rules
- Periodic Backup For System Registry Hives Enabledmediumtest
- Screen Capture Activity Via Psr.EXEmediumtest
- Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deletedmediumtest
- Windows Recall Feature Enabled - Registrymediumtest
- Windows Recall Feature Enabled Via Reg.EXEmediumtest
- Windows Screen Capture with CopyFromScreenmediumtest
- Screen Capture - macOSlowtest
- Screen Capture with Import Toollowtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Screen Capture
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.