T1113 Screen Capture
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.(Citation: CopyFromScreen…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Periodic Backup For System Registry Hives Enabledmediumtest · windows
- Screen Capture Activity Via Psr.EXEmediumtest · windows
- Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deletedmediumtest · windows
- Windows Recall Feature Enabled - Registrymediumtest · windows
- Windows Recall Feature Enabled Via Reg.EXEmediumtest · windows
- Windows Screen Capture with CopyFromScreenmediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.