tfMITRE ATT&CK technique

Screen Capture T1113

Tactic: Collection
Platforms: Linux, macOS, Windows
Version: 1.1
Created: 31 May 2017
Last modified: 12 May 2026

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.[1][2]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 9%

Threat groups91st percentile · 91% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

151

Tools & malwareTop 2%

Tools & malware98th percentile · 98% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 16%

Detection rules84th percentile · 84% of ATT&CK techniques have this many detection rules written or fewer.

Screen Capture MITRE reference T1113

Top 9%of all ATT&CK techniques for number of groups

19 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

VOID MANTICOREG1055 ↗

Has captured screen content during an active Zoom session.1

created 2026-04-201 referenceaka COBALT MYSTIQUE

APT42G1044 ↗

Has used malware, such as GHAMBAR and POWERPOST, to take screenshots.1

created 2025-01-081 reference

Winter VivernG1035 ↗

Delivered PowerShell scripts capable of taking screenshots of victim machines.1

created 2024-07-291 referenceaka TA473

MoustachedBouncerG1019 ↗

Has used plugins to take screenshots on targeted systems.1

created 2023-09-251 reference

Volt TyphoonG1017 ↗

Has obtained a screenshot of the victim's system using the gdi32.dll and gdiplus.dll libraries.1

created 2023-07-271 referenceaka BRONZE SILHOUETTE

GOLD SOUTHFIELDG0115 ↗

Has used the remote monitoring and management tool ConnectWise to obtain screen captures from victim's machines.1

created 2020-09-221 referenceaka Pinchy Spider

All 19 groups for this technique · 6 newest in this preview

1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

2025 Poland Wiper AttacksC0063 ↗

During the 2025 Poland Wiper Attacks, the adversaries captured screenshots of devices using nircmd console through the command nircmd.exe “savescreenshot C:\Windows\Temp\imagetmp.png.1

2025

All 1 campaigns for this technique

151 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

AshTagS9031 ↗

The AshTag AshenOrchestrator component has the ability to take screenshots.1

created 2026-04-20MALWAREcarried by 1 group

LODEINFOS9020 ↗

Has the ability to take screenshots.1 2 3

created 2026-04-17MALWAREcarried by 1 group

HTTPTroyS9007 ↗

Has obtained screen captures leveraging the screen command which captures, encrypts and uploads the stolen image to the adversary controlled C2 server.1

created 2026-04-08MALWAREcarried by 1 group

RedLine StealerS1240 ↗

Can capture screenshots on a compromised host.1 2

created 2025-09-17MALWARE

TONESHELLS1239 ↗

Has conducted screen capturing.1

created 2025-09-15MALWAREcarried by 1 group

HavocS1229 ↗

Can capture screenshots.1 2 3

created 2025-08-05MALWAREcarried by 1 group

All 151 software entries for this technique · 6 newest in this preview

Offense vs defense T1113

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 10Splunk ESCU (cumulative) · 5

first rule: 2019 Q4 · 1 of 1 campaigns plotted

Screen Capture detection strategy DET0346

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Screen Capture via Commands and API Calls

Enterprise

3 platforms

AN0980 · Windows

Unusual use of screen capture APIs (e.g., CopyFromScreen) or command-line tools to write image files to disk.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ParentProcessName	Depends on allowed parent process behaviors in the environment (e.g., explorer.exe vs powershell.exe)
TimeWindow	Can tune alert thresholds for rapid or scheduled screenshots (e.g., interval-based screen capture)
ImageExtension	To detect file writes (e.g., .bmp, .png) that deviate from typical user activity

AN0981 · macOS

Invocation of built-in commands like screencapture or use of undocumented APIs from suspicious parent processes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	process: exec

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandLineRegex	Customize regex for flag detection (e.g., `screencapture -x`) based on usage patterns
ParentProcessName	May vary depending on expected screencapture behavior (Terminal vs remote agent)

AN0982 · Linux

Use of tools like xwd or import to generate screenshots, especially under non-GUI parent processes.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TerminalSession	Filter based on TTY sessions or remote terminal usage
ExecutablePath	Match against known location of xwd/import binaries or renamed variants

Tests10Executorsbash 4 · PowerShell 4 · sh 2Need elevation1 of 10Have prerequisites5Have cleanup10Platformsmacos, linux, windows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Screencapture

macos

bash

—

Yes

Use screencapture command to collect a full desktop screenshot

Input arguments

Name	Type	Default	Description
output_file	path	/tmp/T1113_desktop.png	Output file path

Attack command

screencapture #{output_file}

Cleanup command

rm #{output_file}

GUID4343beda-9c13-487f-a8eb-c85a57b58bbe

Screencapture (silent)

macos

bash

—

Yes

Use screencapture command to collect a full desktop screenshot

Input arguments

Name	Type	Default	Description
output_file	path	/tmp/T1113_desktop.png	Output file path

Attack command

screencapture -x #{output_file}

Cleanup command

rm #{output_file}

GUIDda3a7817-679b-4423-b418-f76cf4866073

X Windows Capture

linux

bash

—

Yes

Use xwd command to collect a full desktop screenshot and review file with xwud

Input arguments

Name	Type	Default	Description
output_file	path	/tmp/T1113_desktop.xwd	Output file path
package_checker	string	rpm -q xorg-x11-apps	Package checking command for linux. Debian system command- dpkg -s x11-apps
package_installer	string	yum install -y xorg-x11-apps	Package installer command for linux. Debian system command- apt-get install x11-apps

Attack command

xwd -root -out #{output_file}
xwud -in #{output_file}

Cleanup command

rm #{output_file}

Prerequisite

Package with XWD and XWUD must exist on device

Check

if #{package_checker} > /dev/null; then exit 0; else exit 1; fi

Satisfy

sudo #{package_installer}

GUID275cd5db-83cf-486f-add5-ace9cc432fb2

X Windows Capture (freebsd)

linux

—

Yes

Use xwd command to collect a full desktop screenshot and review file with xwud

Input arguments

Name	Type	Default	Description
output_file	path	/tmp/T1113_desktop.xwd	Output file path

Attack command

xwd -root -out #{output_file}
xwud -in #{output_file}

Cleanup command

rm #{output_file}

Prerequisite

Package with XWD and XWUD must exist on device

Check

if [ -x "$(command -v xwd)" ]; then exit 0; else exit 1; fi
if [ -x "$(command -v xwud)" ]; then exit 0; else exit 1; fi

Satisfy

pkg install -y xwd xwud

GUIDea5a1b91-5a5a-4aa0-ad5d-46a1ac22d815

Capture Linux Desktop using Import Tool

linux

bash

—

Yes

Use import command from ImageMagick to collect a full desktop screenshot

Input arguments

Name	Type	Default	Description
output_file	path	/tmp/T1113_desktop.png	Output file path

Attack command

import -window root #{output_file}

Cleanup command

rm #{output_file}

Prerequisite

ImageMagick must be installed

Check

if import -help > /dev/null 2>&1; then exit 0; else exit 1; fi

Satisfy

sudo apt install graphicsmagick-imagemagick-compat

GUID0c674dd9-5172-4741-9856-2674e36b3ee0

Capture Linux Desktop using Import Tool (freebsd)

linux

—

Yes

Use import command from ImageMagick to collect a full desktop screenshot

Input arguments

Name	Type	Default	Description
output_file	path	/tmp/T1113_desktop.png	Output file path

Attack command

import -window root #{output_file}

Cleanup command

rm #{output_file}

Prerequisite

ImageMagick must be installed

Check

if import -help > /dev/null 2>&1; then exit 0; else exit 1; fi

Satisfy

pkg install -y ImageMagick7

GUID338ed045-5b6d-4479-8168-1b4ba4dbb369

Windows Screencapture

windows

PowerShell

—

Yes

Use Psr.exe binary to collect screenshots of user display. Test will do left mouse click to simulate user behaviour

Input arguments

Name	Type	Default	Description
output_file	path	c:\temp\T1113_desktop.zip	Output file path
recording_time	integer	5	Time to take screenshots

Attack command

cmd /c start /b psr.exe /start /output #{output_file} /sc 1 /gui 0 /stopevent 12
Add-Type -MemberDefinition '[DllImport("user32.dll")] public static extern void mouse_event(int flags, int dx, int dy, int cButtons, int info);' -Name U32 -Namespace W;
[W.U32]::mouse_event(0x02 -bor 0x04 -bor 0x01, 0, 0, 0, 0);
cmd /c "timeout #{recording_time} > NULL && psr.exe /stop"

Cleanup command

rm #{output_file} -ErrorAction Ignore

GUID853abb09-0917-46aa-b0d2-8ecddf96bfb6

Windows Screen Capture (CopyFromScreen)

windows

PowerShell

—

Yes

Take a screen capture of the desktop through a call to the [Graphics.CopyFromScreen] .NET API. [Graphics.CopyFromScreen]: https://docs.microsoft.com/en-us/dotnet/api/system.drawing.graphics.copyfromscreen

Input arguments

Name	Type	Default	Description
output_file	path	$env:TEMP\T1113.png	Path where captured results will be placed

Attack command

Add-Type -AssemblyName System.Windows.Forms
$screen = [Windows.Forms.SystemInformation]::VirtualScreen
$bitmap = New-Object Drawing.Bitmap $screen.Width, $screen.Height
$graphic = [Drawing.Graphics]::FromImage($bitmap)
$graphic.CopyFromScreen($screen.Left, $screen.Top, 0, 0, $bitmap.Size)
$bitmap.Save("#{output_file}")

Cleanup command

Remove-Item #{output_file} -ErrorAction Ignore

GUID59e275c9-0963-46fc-8bcc-4a1ddab46b92

Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted

windows

PowerShell

Required

—

Yes

RDP Bitmap Cache Extraction via bmc-tools

windows

PowerShell

—

Yes

Simulates an attacker extracting the RDP bitmap cache using the ANSSI "bmc-tools.py" script. This test requires valid RDP bitmap cache files to exist on the system (usually created after an outgoing RDP connection is made).

Input arguments

Name	Type	Default	Description
cache_path	path	$env:LOCALAPPDATA\Microsoft\Terminal Server Client\Cache	Path to the RDP Cache directory or specific .bmc file
output_dir	path	$env:TEMP\rdp_screens	Directory to save reconstructed images

Attack command

$url = 'https://raw.githubusercontent.com/ANSSI-FR/bmc-tools/master/bmc-tools.py'
$toolsDir = "$env:TEMP\bmc-tools.py"
 
# create output directory
New-Item -ItemType Directory -Path #{output_dir} -Force | Out-Null

# python script download
& curl.exe -L $url --output $toolsDir
 
# execution step
if (Test-Path $toolsDir) { python $toolsDir -s "#{cache_path}" -d #{output_dir} -b }

Cleanup command

Remove-Item "$env:TEMP\bmc-tools.py" -ErrorAction SilentlyContinue
Remove-Item #{output_dir} -Recurse -Force -ErrorAction SilentlyContinue

Prerequisite

Python must be installed and in the PATH to run bmc-tools.py

Check

if (Get-Command python -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }

Satisfy

Write-Host "Please install Python manually."

GUIDf6c03934-0748-44a3-afb6-037ed66699a2

Tests from Atomic Red Team (MIT licence) · technique definition

Screen Capture detections T1113

15 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 16%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs