T1113

Screen Capture

Linux · macOS · Windowsnothing on this site yetT1113 on attack.mitre.org

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen`, `xwd`, or `screencapture`.
MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

Checklists and playbooks to open while the alert is still live.

Playbook for this stage

Suspected data theft by an insider

A resignation with unusual file access, a DLP alert, or an unexplained large transfer.

how MITRE says to see it

Detect Screen Capture via Commands and API Calls

Unusual use of screen capture APIs (e.g., CopyFromScreen) or command-line tools to write image files to disk.
Invocation of built-in commands like screencapture or use of undocumented APIs from suspicious parent processes.
Use of tools like xwd or import to generate screenshots, especially under non-GUI parent processes.

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.