MITRE ATT&CKtechnique

T1513 Screen Capture

Published 2019-08-08 Modified 2026-05-12 Official page ↗
Domain
mobile
Tactics
Collection
Platforms
Android
Version
1.3
Created
2019-08-08

Description

Adversaries may use screen capture to collect additional information about a target device, such as applications running in the foreground, user data, credentials, or other sensitive information. Applications running in the background can capture screenshots or videos of another application running in the foreground by using the Android `MediaProjectionManager` (generally requires the device user to grant consent). Background applications can also use Android accessibility services to capture screen contents being displayed by a foreground application. An adversary with root access or Android Debug Bridge (adb) access could call the Android `screencap` or `screenrecord` commands.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (3)

  • M1011 User Guidance mitigation
  • M1012 Enterprise Policy mitigation
  • M1013 Application Developer Guidance mitigation

Referenced by MITRE ATT&CK · uses (27)

  • S9004 Crocodilus software (malware)
  • S1185 LightSpy software (malware)
  • S1195 SpyC23 software (malware)
  • S1094 BRATA software (malware)
  • S1095 AhRat software (malware)
  • S1083 Chameleon software (malware)
  • S1082 Sunbird software (malware)
  • S1079 BOULDSPY software (malware)
  • S1077 Hornbill software (malware)
  • S1069 TangleBot software (malware)
  • S1062 S.O.V.A. software (malware)
  • S1054 Drinik software (malware)
  • S0655 BusyGasper software (malware)
  • S0558 Tiktok Pro software (malware)
  • S0551 GoldenEagle software (malware)
  • S0489 WolfRAT software (malware)
  • S0485 Mandrake software (malware)
  • S0478 EventBot software (malware)
  • S0479 DEFENSOR ID software (malware)
  • S0427 TrickMo software (malware)
  • S0422 Anubis software (malware)
  • S0423 Ginp software (malware)
  • S0421 GolfSpy software (malware)
  • S0407 Monokle software (malware)
  • S0408 FlexiSpy software (tool)
  • S0405 Exodus software (malware)
  • S0324 SpyDealer software (malware)

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-648 Collect Data from Screen Capture attack pattern

References