Description
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.(Citation: CopyFromScreen .NET)(Citation: Antiquated Mac Malware)
Platforms
Threat Groups (19)
| ID | Group | Context |
|---|---|---|
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has captured browser screenshots using [TRANSLATEXT](https://attack.mitre.org/software/S1201).(Citati... |
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has obtained a screenshot of the victim's system using the gdi32.dll and gdiplus.dll libraries.(... |
| G0035 | Dragonfly | [Dragonfly](https://attack.mitre.org/groups/G0035) has performed screen captures of victims, including by using a tool, scr.exe (which matched the has... |
| G0069 | MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) has used malware that can capture screenshots of the victim’s machine.(Citation: Securelist MuddyW... |
| G0047 | Gamaredon Group | [Gamaredon Group](https://attack.mitre.org/groups/G0047)'s malware can take screenshots of the compromised computer every minute.(Citation: ESET Gamar... |
| G0046 | FIN7 | [FIN7](https://attack.mitre.org/groups/G0046) captured screenshots and desktop video recordings.(Citation: DOJ FIN7 Aug 2018) |
| G0087 | APT39 | [APT39](https://attack.mitre.org/groups/G0087) has used a screen capture utility to take screenshots on a compromised host.(Citation: Symantec Chafer ... |
| G0049 | OilRig | [OilRig](https://attack.mitre.org/groups/G0049) has a tool called CANDYKING to capture a screenshot of user's desktop.(Citation: FireEye APT34 Webinar... |
| G1019 | MoustachedBouncer | [MoustachedBouncer](https://attack.mitre.org/groups/G1019) has used plugins to take screenshots on targeted systems.(Citation: MoustachedBouncer ESET ... |
| G0043 | Group5 | Malware used by [Group5](https://attack.mitre.org/groups/G0043) is capable of watching the victim's screen.(Citation: Citizen Lab Group5) |
| G1035 | Winter Vivern | [Winter Vivern](https://attack.mitre.org/groups/G1035) delivered PowerShell scripts capable of taking screenshots of victim machines.(Citation: CERT-U... |
| G0070 | Dark Caracal | [Dark Caracal](https://attack.mitre.org/groups/G0070) took screenshots using their Windows malware.(Citation: Lookout Dark Caracal Jan 2018) |
| G0060 | BRONZE BUTLER | [BRONZE BUTLER](https://attack.mitre.org/groups/G0060) has used a tool to capture screenshots.(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation:... |
| G0007 | APT28 | [APT28](https://attack.mitre.org/groups/G0007) has used tools to take screenshots from victims.(Citation: ESET Sednit Part 2)(Citation: XAgentOSX 2017... |
| G1044 | APT42 | [APT42](https://attack.mitre.org/groups/G1044) has used malware, such as GHAMBAR and POWERPOST, to take screenshots.(Citation: Mandiant APT42-charms) |
| G0115 | GOLD SOUTHFIELD | [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) has used the remote monitoring and management tool ConnectWise to obtain screen captures from... |
| G0091 | Silence | [Silence](https://attack.mitre.org/groups/G0091) can capture victim screen activity.(Citation: SecureList Silence Nov 2017)(Citation: Group IB Silence... |
| G1055 | VOID MANTICORE | [VOID MANTICORE](https://attack.mitre.org/groups/G1055) has captured screen content during an active Zoom session.(Citation: FBI IC3 Flash VOID MANTIC... |
| G0059 | Magic Hound | [Magic Hound](https://attack.mitre.org/groups/G0059) malware can take a screenshot and upload the file to its C2 server.(Citation: Unit 42 Magic Hound... |
Associated Software (151)
| ID | Name | Type | Context |
|---|---|---|---|
| S0662 | RCSession | Malware | [RCSession](https://attack.mitre.org/software/S0662) can capture screenshots from a compromised host.(Citation: Profero APT27 December 2020) |
| S0686 | QuietSieve | Malware | [QuietSieve](https://attack.mitre.org/software/S0686) has taken screenshots every five minutes and saved them to the user's local Application Data fol... |
| S0417 | GRIFFON | Malware | [GRIFFON](https://attack.mitre.org/software/S0417) has used a screenshot module that can be used to take a screenshot of the remote system.(Citation: ... |
| S0248 | yty | Malware | [yty](https://attack.mitre.org/software/S0248) collects screenshots of the victim machine.(Citation: ASERT Donot March 2018) |
| S0213 | DOGCALL | Malware | [DOGCALL](https://attack.mitre.org/software/S0213) is capable of capturing screenshots of the victim's machine.(Citation: FireEye APT37 Feb 2018)(Cita... |
| S0184 | POWRUNER | Malware | [POWRUNER](https://attack.mitre.org/software/S0184) can capture a screenshot from a victim.(Citation: FireEye APT34 Dec 2017) |
| S0546 | SharpStage | Malware | [SharpStage](https://attack.mitre.org/software/S0546) has the ability to capture the victim's screen.(Citation: Cybereason Molerats Dec 2020)(Citation... |
| S0151 | HALFBAKED | Malware | [HALFBAKED](https://attack.mitre.org/software/S0151) can obtain screenshots from the victim.(Citation: FireEye FIN7 April 2017) |
| S0271 | KEYMARBLE | Malware | [KEYMARBLE](https://attack.mitre.org/software/S0271) can capture screenshots of the victim’s machine.(Citation: US-CERT KEYMARBLE Aug 2018) |
| S0386 | Ursnif | Malware | [Ursnif](https://attack.mitre.org/software/S0386) has used hooked APIs to take screenshots.(Citation: TrendMicro Ursnif Mar 2015)(Citation: TrendMicro... |
| S0086 | ZLib | Malware | [ZLib](https://attack.mitre.org/software/S0086) has the ability to obtain screenshots of the compromised system.(Citation: Cylance Dust Storm) |
| S0153 | RedLeaves | Malware | [RedLeaves](https://attack.mitre.org/software/S0153) can capture screenshots.(Citation: FireEye APT10 April 2017)(Citation: Accenture Hogfish April 20... |
| S0330 | Zeus Panda | Malware | [Zeus Panda](https://attack.mitre.org/software/S0330) can take screenshots of the victim’s machine.(Citation: GDATA Zeus Panda June 2017) |
| S1229 | Havoc | Malware | [Havoc](https://attack.mitre.org/software/S1229) can capture screenshots.(Citation: Havoc Framework Documentation)(Citation: Zscaler Havoc FEB 2023)(C... |
| S0167 | Matryoshka | Malware | [Matryoshka](https://attack.mitre.org/software/S0167) is capable of performing screen captures.(Citation: ClearSky Wilted Tulip July 2017)(Citation: C... |
| S0163 | Janicab | Malware | [Janicab](https://attack.mitre.org/software/S0163) captured screenshots and sent them out to a C2 server.(Citation: f-secure janicab)(Citation: Janica... |
| S1239 | TONESHELL | Malware | [TONESHELL](https://attack.mitre.org/software/S1239) has conducted screen capturing.(Citation: Palo Alto Unit42 STATELY TAURUS TONESHELL September 202... |
| S0088 | Kasidet | Malware | [Kasidet](https://attack.mitre.org/software/S0088) has the ability to initiate keylogging and screen captures.(Citation: Zscaler Kasidet) |
| S0629 | RainyDay | Malware | [RainyDay](https://attack.mitre.org/software/S0629) has the ability to capture screenshots.(Citation: Bitdefender Naikon April 2021) |
| S0622 | AppleSeed | Malware | [AppleSeed](https://attack.mitre.org/software/S0622) can take screenshots on a compromised host by calling a series of APIs.(Citation: Malwarebytes Ki... |
References
- Microsoft. (n.d.). Graphics.CopyFromScreen Method. Retrieved March 24, 2020.
- Thomas Reed. (2017, January 18). New Mac backdoor using antiquated code. Retrieved July 5, 2017.
Frequently Asked Questions
What is T1113 (Screen Capture)?
T1113 is a MITRE ATT&CK technique named 'Screen Capture'. It belongs to the Collection tactic(s). Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access too...
How can T1113 be detected?
Detection of T1113 (Screen Capture) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1113?
Follow defense-in-depth principles including network segmentation, least privilege access, security monitoring, and regular patching to reduce the risk of this technique.
Which threat groups use T1113?
Known threat groups using T1113 include: Kimsuky, Volt Typhoon, Dragonfly, MuddyWater, Gamaredon Group, FIN7, APT39, OilRig.