kevmap

Techniques › T1113

T1113 Screen Capture

collection — Linux, macOS, Windows · attack.mitre.org · JSON

1
MITRE detection strategy
3
analytics
10
Sigma rules tagged attack.t1113
0
KEV CVEs mapped here
<p>Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or <code>screencapture</code>.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1113

Screen Capture - macOS lowtest
Author: remotephone, oscd.community · 2020-10-13 (modified 2021-11-27) · logsource: product=macos category=process_creation · 0877ed01-da46-4c49-8476-d49cdd80dfa7
Detects attempts to use screencapture to collect macOS screenshots
Techniques: T1113
Screen Capture Activity Via Psr.EXE mediumtest
Author: Beyu Denis, oscd.community · 2019-10-12 (modified 2024-01-04) · logsource: product=windows category=process_creation · 2158f96f-43c2-43cb-952a-ab4580f32382
Detects execution of Windows Problem Steps Recorder (psr.exe), a utility used to record the user screen and clicks.
Techniques: T1113
Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted mediumtest
Author: Sajid Nawaz Khan · 2024-06-02 · logsource: product=windows category=registry_delete · 5dfc1465-8f65-4fde-8eb5-6194380c6a62
Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" registry value. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.
Techniques: T1113
System Drawing DLL Load lowtest
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) · 2020-05-02 (modified 2023-02-22) · logsource: product=windows category=image_load · 666ecfc7-229d-42b8-821e-1a8f8cb7057c
Detects processes loading "System.Drawing.ni.dll". This could be an indicator of potential Screen Capture.
Techniques: T1113
Windows Recall Feature Enabled - Registry mediumtest
Author: Sajid Nawaz Khan · 2024-06-02 · logsource: product=windows category=registry_set · 75180c5f-4ea1-461a-a4f6-6e4700c065d4
Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by setting the value of "DisableAIDataAnalysis" to "0". Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.
Techniques: T1113
Windows Recall Feature Enabled Via Reg.EXE mediumtest
Author: Sajid Nawaz Khan · 2024-06-02 · logsource: product=windows category=process_creation · 817f252c-5143-4dae-b418-48c3e9f63728
Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" value, or setting it to 0. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.
Techniques: T1113
Periodic Backup For System Registry Hives Enabled mediumtest
Author: Nasreddine Bencherchali (Nextron Systems) · 2024-07-01 · logsource: product=windows category=registry_set · 973ef012-8f1a-4c40-93b4-7e659a5cd17f
Detects the enabling of the "EnablePeriodicBackup" registry value. Once enabled, The OS will backup System registry hives on restarts to the "C:\Windows\System32\config\RegBack" folder. Windows creates a "RegIdleBackup" task to manage subsequent backups. Registry backup was a default behavior on Windows and was disabled as of "Windows 10, version 1803".
Techniques: T1113
Windows Screen Capture with CopyFromScreen mediumtest
Author: frack113 · 2021-12-28 (modified 2022-07-07) · logsource: product=windows category=ps_script · d4a11f63-2390-411c-9adf-d791fd152830
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations
Techniques: T1113
Screen Capture with Import Tool lowtest
Author: Pawel Mazur · 2021-09-21 (modified 2022-10-09) · logsource: product=linux service=auditd · dbe4b9c5-c254-4258-9688-d6af0b7967fd
Detects adversary creating screen capture of a desktop with Import Tool. Highly recommended using rule on servers, due to high usage of screenshot utilities on user workstations. ImageMagick must be installed.
Techniques: T1113
Screen Capture with Xwd lowtest
Author: Pawel Mazur · 2021-09-13 (modified 2022-12-18) · logsource: product=linux service=auditd · e2f17c5d-b02a-442b-9052-6eb89c9fec9c
Detects adversary creating screen capture of a full with xwd. Highly recommended using rule on servers, due high usage of screenshot utilities on user workstations
Techniques: T1113