MITRE ATT&CKtechnique

T1113 Screen Capture

Published 2017-05-31 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Collection
Platforms
Linux, macOS, Windows
Version
1.1
Created
2017-05-31

Description

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (172)

  • S9058 SIGHTGRAB software (malware)
  • C0063 2025 Poland Wiper Attacks campaign
  • G1055 VOID MANTICORE group
  • S9031 AshTag software (malware)
  • S9020 LODEINFO software (malware)
  • S9007 HTTPTroy software (malware)
  • S1240 RedLine Stealer software (malware)
  • S1239 TONESHELL software (malware)
  • S1229 Havoc software (malware)
  • S1213 Lumma Stealer software (malware)
  • S1209 Quick Assist software (tool)
  • S1207 XLoader software (malware)
  • S1201 TRANSLATEXT software (malware)
  • S1196 Troll Stealer software (malware)
  • G1044 APT42 group
  • S1185 LightSpy software (malware)
  • S1159 DUSTTRAP software (malware)
  • S1156 Manjusaka software (malware)
  • S1153 Cuckoo Stealer software (malware)
  • S1149 CHIMNEYSWEEP software (malware)
  • S1148 Raccoon Stealer software (malware)
  • G1035 Winter Vivern group
  • S1142 LunarMail software (malware)
  • S1122 Mispadu software (malware)
  • S1107 NKAbuse software (malware)
  • S1090 NightClub software (malware)
  • G1019 MoustachedBouncer group
  • S1087 AsyncRAT software (tool)
  • S1081 BADHATCH software (malware)
  • G1017 Volt Typhoon group
Show all 172 ›

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-648 Collect Data from Screen Capture attack pattern

References