Screen Capture T1113

Tactic: Collection

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.

Events covered

14 catalog events are tagged with this technique by at least one rule.

Authoring guide

These 27 rules share fields, values, and exclusions.

Fields filtered most (29 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
process_name8eq 3, ends_with 2, regex_match 2, in 1(?i)nircmd\.exe, .exe, deepin-screenshot, flameshot, gnome-screenshot
CommandLine6contains 4, regex_match 2(?i)\s(execcmd|runinteractive(cmd)?|savescreenshot(full|w..., -encodedcommand, -start, /shadow, /start
Image6ends_with 3, contains 2, eq 1\\appdata\\roaming\\, /usr/sbin/screencapture, \mstsc.exe, \psr.exe, \reg.exe
TargetFilename5contains 4, starts_with 1\\appdata\\roaming\\, /private/tmp/, /tmp/, /users/shared/, \\remcos\\
TargetObject5ends_with 5\control\session manager\configuration..., \microsoft\windows\windowsai\disableaidataanalysis, \software\policies\microsoft\windows nt\terminal services, \software\policies\microsoft\windows nt\terminal services\shadow, \software\policies\microsoft\windows\windowsai\disableaid...
EventID4eq 44688, 1, 4104
file_name4ends_with 2, in 2*.bmp, *.gif, *.jpg, .dat, .wav
Details3eq 30x00000001, 0x00000002, 0x00000003, dword (0x00000000), dword (0x00000001)
EventType3eq 2, in 1exec, deletevalue, exec_event, modification, start
ScriptBlockText3contains 2, in 2, eq 1*[drawing.graphics]::fromimage*, *drawing.bitmap*, *graphics.fromimage*, .copyfromscreen, copyfromscreen
event.category3eq 3process, registry
event.type3eq 3start, change
OriginalFileName2eq 2mstsc.exe, reg.exe
a02eq 2import, xwd
a12eq 2, ends_with 1-out, -root, -window, .jpeg, .jpg

Top indicator values (125 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
event.categoryeq
process
3142
event.typeeq
start
31078
CommandLineregex_match
(?i)\s(execcmd|runinteractive(cmd)?|savescreenshot(full|win)?|regdel(val|key)...
22
EventIDeq
4688
2317
Imagecontains
\\appdata\\roaming\\
22
ScriptBlockTextcontains
.copyfromscreen
22
TargetFilenamecontains
\\appdata\\roaming\\
22
process_nameends_with
.exe
23
process_nameregex_match
(?i)nircmd\.exe
22
typeeq
execve
237
CommandLinecontains
-encodedcommand
14
CommandLinecontains
-start
1
CommandLinecontains
/shadow
1
CommandLinecontains
/start
1
CommandLinecontains
0
16
CommandLinecontains
add
134
CommandLinecontains
delete
131
CommandLinecontains
disableaidataanalysis
1
CommandLinecontains
microsoft\windows\windowsai
1
CommandLinecontains
mstsc
1
Detailseq
0x00000001
161
Detailseq
0x00000002
14
Detailseq
0x00000003
1
Detailseq
0x00000004
14
Detailseq
1
120
Detailseq
2
14
Detailseq
3
12
Detailseq
4
17
Detailseq
dword (0x00000000)
138
Detailseq
dword (0x00000001)
140

Exclusions (36 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
CommandLinecontains
d:\teamboard_backup\teamboard_
1
CommandLineeq
screencapture --help
1
EventDatacontains
gc_service.exe
1
EventDatacontains
gc_worker.exe
1
ParentImagecontains
gc_service.exe
1
ParentImagecontains
gc_worker.exe
1
ParentImageeq
/system/library/coreservices/loginwindow.app/contents/macos/loginwindow
1
ParentImageeq
/system/library/coreservices/systemuiserver.app/contents/macos/systemuiserver
1
ParentImageeq
c:\program files\microsoft vs code\code.exe
1
ParentImageeq
c:\program files\repairtech\syncro\syncro.app.runner.exe
1
ParentImageeq
c:\program files\repairtech\syncro\syncro.service.runner.exe
1
process.Ext.api.parameters.bufferstarts_with
# WPF Color Picker with global Ctrl+LeftClick capture
1
process.Ext.api.parameters.content_namestarts_with
?:\Program Files (x86)\
1
process.Ext.api.parameters.content_namestarts_with
?:\Program Files\
1
process.Ext.api.parameters.content_namestarts_with
H:\Scripts\
1

Rules under this technique

These vendors publish rules tagged with this technique.

Domain: Endpoint

Platform (all)

Sigma 13 rules

Elastic 5 rules

Splunk 8 rules

Kusto 1 rule