t1113-screen-capture

name	T1113_screen-capture
description	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation.
category	information-gathering
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1113","collection","linux","windows","macos"]
technique_id	T1113
tactic	collection
all_tactics	["collection"]
platforms	["Linux","Windows","macOS"]
mitre_url	https://attack.mitre.org/techniques/T1113
tech_stack	["linux","windows","macos"]
cwe_ids	["CWE-200"]
chains_with	[]
prerequisites	[]
severity_boost	{}

T1113 Screen Capture

High-Level Description

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.

Kill Chain Phase

• Collection (TA0009)

Platforms: Linux, Windows, macOS

What to Check

• Identify if Screen Capture technique is applicable to target environment
• Check Linux systems for indicators of Screen Capture
• Check Windows systems for indicators of Screen Capture
• Check macOS systems for indicators of Screen Capture
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Screencapture

Use screencapture command to collect a full desktop screenshot

Supported Platforms: macos

screencapture #{output_file}

Atomic Test 2: Screencapture (silent)

Use screencapture command to collect a full desktop screenshot

Supported Platforms: macos

screencapture -x #{output_file}

Atomic Test 3: X Windows Capture

Use xwd command to collect a full desktop screenshot and review file with xwud

Supported Platforms: linux

xwd -root -out #{output_file}
xwud -in #{output_file}

Dependencies:

• Package with XWD and XWUD must exist on device

Atomic Test 4: X Windows Capture (freebsd)