CyberStack

MITRE ATT&CK / Techniques / T1113

Screen Capture

ID
T1113
Tactics
TA0009 Collection
Platforms
Linux, macOS, Windows
Data sources
Process Creation, Module Load
Source
attack.mitre.org
MITRE last modified
12 May 2026

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.[1][2]

Detection

Groups (19)

Software (152)

Showing 60 of 152. Full list on attack.mitre.org.

References

  1. CopyFromScreen .NET
  2. Antiquated Mac Malware