Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1113: Screen Capture

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.[1][2]

EnterpriseT1113TechniqueObject v1.1 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

Screen Capture (T1113) matters because it turns a compromised workstation into a source of visible business information: open emails, documents, chats, dashboards, credentials displayed on screen, and operational views. MITRE places it in Collection across Windows, macOS, and Linux, and notes it can be performed through RAT features, native utilities, or API calls. For leaders, this is a reminder that post-compromise monitoring must cover what an intruder can observe, not only what files they steal.

Executive priority

Prioritize this technique where users handle sensitive data, privileged administration, financial operations, regulated records, or operational/critical infrastructure dashboards. ATT&CK relationships link this behavior to many groups and to a campaign involving Polish energy infrastructure, so the business question is whether endpoint monitoring, remote access governance, and incident response playbooks can identify suspicious screen collection before it supports espionage, fraud, or operational decision compromise.

Technical view

Validate coverage on Windows, macOS, and Linux for screenshot activity initiated by unusual processes, RAT-like tooling, command-line utilities, and API-based capture patterns. MITRE provides no official detection text for T1113, but the related detection strategy DET0346 is explicitly named “Detect Screen Capture via Commands and API Calls,” which points detection engineers toward process, command, and API-level evidence. IR teams should treat screen capture findings as collection-stage activity and pivot to nearby remote access, persistence, credential exposure, and exfiltration evidence.

Likely telemetry

  • Endpoint process creation and command-line telemetry for screenshot utilities such as xwd and screencapture where applicable
  • Windows endpoint telemetry that can expose use of screen capture APIs such as CopyFromScreen or suspicious .NET-based capture behavior
  • EDR or host activity showing RAT/backdoor processes invoking screen capture functions
  • File creation or modification telemetry for newly generated image files in unusual locations
  • User session context, interactive logon state, desktop access, and remote access session records

Detection direction

  • Baseline legitimate screenshot and remote support behavior to reduce false positives from help desk tools, collaboration software, QA/testing tools, and user-initiated captures.
  • Tune for unusual parent-child process relationships, unexpected capture utilities, non-interactive contexts, or screen capture by processes not normally associated with user productivity or administration.
  • Correlate screen capture activity with other post-compromise signals, especially RAT execution, remote access, credential access opportunities, and outbound transfer of image files.
  • Confirm coverage parity across Linux, macOS, and Windows; native utility monitoring often differs by operating system.
  • Use the ATT&CK relationship to DET0346 as a starting point, but do not assume coverage because MITRE’s official detection field for this technique is not provided.

Mitigation priorities

  • No specific official ATT&CK mitigation text was supplied for this object, so control work should start with visibility and governance validation rather than assuming a single preventive fix.
  • Restrict and monitor remote access tools and administrative utilities that can expose desktop content, especially on sensitive user and administrator workstations.
  • Harden endpoint monitoring to capture process, command-line, file creation, and relevant API-level signals where feasible.
  • Reduce unnecessary exposure of sensitive data on shared workstations and privileged sessions through least privilege, session controls, and operational procedures.
  • Ensure incident response playbooks treat suspected screen capture as potential sensitive information exposure and include scoping for what was visible during the compromised session.
Analyst notes and limits

The relationship set is broad, including multiple espionage and financially motivated groups, software such as TinyZBot, PlugX, and BISCUIT, and a campaign involving energy infrastructure. That breadth makes T1113 useful for threat-informed control validation, but local risk depends on which users, applications, and operational displays are accessible from compromised endpoints.

This take is based only on the supplied ATT&CK STIX fields, references, and relationships. MITRE did not provide official detection guidance in the object fields, and no official mitigations were supplied here. Local telemetry, approved remote support workflows, operating system logging depth, and EDR capability determine whether this behavior can be reliably detected.

Official MITRE ATT&CK definition

Screen Capture

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

Associated objects

Groups, software, and campaigns

Group Enterprise

G1055: VOID MANTICORE

VOID MANTICORE is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS).[1] Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States.[1][2] VOID MANTICORE conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including HomeLand Justice in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation.[1][3] VOID MANTICORE has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity.[4]

Group Enterprise

G0035: Dragonfly

Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.[1][2] Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.[3][4][5][6][7][8][9]

Group Enterprise

G0060: BRONZE BUTLER

BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.[1][2][3]

Group Enterprise

G0047: Gamaredon Group

Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns.[1][2][3][4][5]

In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia’s Federal Security Service (FSB) Center 18, an assessment later supported by multiple independent cybersecurity researchers. [6][5]

Group Enterprise

G0049: OilRig

OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.[1][2][3][4][5][6][7]

Group Enterprise

G0007: APT28

APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.[1][2] This group has been active since at least 2004.[3][4][5][6][7][8][9][10][11][12][13]

APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.[5] In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.[14] Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.

Group Enterprise

G0115: GOLD SOUTHFIELD

GOLD SOUTHFIELD is a financially motivated threat group active since at least 2018 that operates the REvil Ransomware-as-a Service (RaaS). GOLD SOUTHFIELD provides backend infrastructure for affiliates recruited on underground forums to perpetrate high value deployments. By early 2020, GOLD SOUTHFIELD started capitalizing on the new trend of stealing data and further extorting the victim to pay for their data to not get publicly leaked.[1][2][3][4]

Group Enterprise

G1044: APT42

APT42 is an Iranian-sponsored threat group that conducts cyber espionage and surveillance.[1] The group primarily focuses on targets in the Middle East region, but has targeted a variety of industries and countries since at least 2015.[1] APT42 starts cyber operations through spearphishing emails and/or the PINEFLOWER Android malware, then monitors and collects information from the compromised systems and devices.[1] Finally, APT42 exfiltrates data using native features and open-source tools.[2]

APT42 activities have been linked to Magic Hound by other commercial vendors. While there are behavior and software overlaps between Magic Hound and APT42, they appear to be distinct entities and are tracked as separate entities by their originating vendor.

Group Enterprise

G0059: Magic Hound

Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.[1][2][3][4][5]

Group Enterprise

G0069: MuddyWater

MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).[1] Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication. [2][3][4][5][6][7][8][9][10][11][12][13]

Group Enterprise

G1035: Winter Vivern

Winter Vivern is a group linked to Russian and Belorussian interests active since at least 2020 targeting various European government and NGO entities, along with sporadic targeting of Indian and US victims. The group leverages a combination of document-based phishing activity and server-side exploitation for initial access, leveraging adversary-controlled and -created infrastructure for follow-on command and control.[1][2][3][4][5]

Malware Enterprise

S9031: AshTag

AshTag is a modular .NET backdoor with multiple features that has been used by WIRTE since at least 2025. AshTag is designed for persistence and remote command execution and can masquerade as a legitimate VisualServer utility.[1]

Windows
Tool Enterprise

S0192: Pupy

Pupy is an open source, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool. [1] It is written in Python and can be generated as a payload in several different ways (Windows exe, Python file, PowerShell oneliner/file, Linux elf, APK, Rubber Ducky, etc.). [1] Pupy is publicly available on GitHub. [1]

LinuxWindowsmacOS
Malware Enterprise

S0182: FinFisher

FinFisher is a government-grade commercial surveillance spyware reportedly sold exclusively to government agencies for use in targeted and lawful criminal investigations. It is heavily obfuscated and uses multiple anti-analysis techniques. It has other variants including Wingbird. [1] [2] [3] [4] [5]

WindowsAndroid
Malware Enterprise

S1207: XLoader

XLoader is an infostealer malware in use since at least 2016. Previously known and sometimes still referred to as Formbook, XLoader is a Malware as a Service (MaaS) known for stealing data from web browsers, email clients and File Transfer Protocol (FTP) applications.[1][2][3][4][5]

Windows
Malware Enterprise

S0128: BADNEWS

BADNEWS is malware that has been used by the actors responsible for the Patchwork campaign. Its name was given due to its use of RSS feeds, forums, and blogs for command and control. [1] [2]

Windows
Relationship explorer

All related ATT&CK context

uses · Malware S9031: AshTag Enterprise uses · Malware S0147: Pteranodon Enterprise uses · Group G1055: VOID MANTICORE Enterprise uses · Malware S0417: GRIFFON Enterprise uses · Malware S0044: JHUHUGIT Enterprise uses · Malware S0331: Agent Tesla Enterprise uses · Group G0035: Dragonfly Enterprise uses · Tool S0192: Pupy Enterprise uses · Malware S0199: TURNEDUP Enterprise uses · Malware S0094: Trojan.Karagany Enterprise uses · Malware S0182: FinFisher Enterprise uses · Malware S1207: XLoader Enterprise uses · Malware S0338: Cobian RAT Enterprise uses · Malware S0128: BADNEWS Enterprise uses · Malware S0458: Ramsay Enterprise uses · Malware S0089: BlackEnergy Enterprise uses · Malware S1196: Troll Stealer Enterprise uses · Malware S0030: Carbanak Enterprise uses · Malware S1239: TONESHELL Enterprise uses · Malware S0644: ObliqueRAT Enterprise uses · Malware S0660: Clambling Enterprise uses · Malware S1213: Lumma Stealer Enterprise uses · Tool S1050: PcShare Enterprise uses · Tool S0363: Empire Enterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
1e105ee34a558d18...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.1 Current bundle 1e105ee34a55…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    CopyFromScreen .NET

    Microsoft. (n.d.). Graphics.CopyFromScreen Method. Retrieved March 24, 2020.

    Open source URL
  2. [2]
    Antiquated Mac Malware

    Thomas Reed. (2017, January 18). New Mac backdoor using antiquated code. Retrieved July 5, 2017.

    Open source URL
  3. [3]
    mitre-attack T1113
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use