T1113: Screen Capture
AI Answer
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or (Source: MITRE ATT&CK T1113)
ATT&CK Mapping
| Field | Value |
|---|---|
| Technique ID | T1113 |
| Name | Screen Capture |
| Tactic | Collection (collection) |
| Platforms | Linux, macOS, Windows |
| Sub-technique | No |
Why it matters
In the OpenTrojan knowledge graph, Screen Capture (T1113) is one of the highest-connectivity ATT&CK techniques: 171 MITRE STIX relationships reference this technique; 19 threat groups observed using it; 151 software families associated; 1 campaigns associated. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.
How attackers use it
Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1113).
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.
Detection
DET0346 Detect Screen Capture via Commands and API Calls AN0980 Unusual use of screen capture APIs (e.g., CopyFromScreen) or command-line tools to write image files to disk. AN0981 Invocation of built-in commands like screencapture or use of undocumented APIs from suspicious parent processes. AN0982 Use of tools like xwd or import to generate screenshots, especially under non-GUI parent processes.
Detection strategy text is from the MITRE ATT&CK official technique page (https://attack.mitre.org/techniques/T1113).
Mitigation
Not available — no MITRE course-of-action was found for this technique in the ingested dataset.
Related Software
- RCSession
- QuietSieve
- GRIFFON
- yty
- DOGCALL
- POWRUNER
- SharpStage
- HALFBAKED
- KEYMARBLE
- Ursnif
- ZLib
- RedLeaves
Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).
Related Threat Groups
- Kimsuky
- Volt Typhoon
- Dragonfly
- MuddyWater
- Gamaredon Group
- FIN7
- APT39
- OilRig
- MoustachedBouncer
- Group5
- Winter Vivern
- Dark Caracal
Group associations are from MITRE ATT&CK STIX relationships.
Related Campaigns
- 2025 Poland Wiper Attacks
Campaign associations are from MITRE ATT&CK STIX relationships.
References
Source Attribution
Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review
Start Investigation
Move from reading to investigating T1113 Screen Capture. The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about T1113 Screen Capture?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.