[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1113":3},{"item":4,"lessons":18,"controls":40,"related":68},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1113","T1113","Screen Capture",5,"MITRE","**What attackers do.** Attackers take screenshots of a user's desktop to collect information they can see on screen, such as documents, messages or credentials. This serves the Collection tactic.\n\n**How to defend.** Use endpoint protection that detects screen capture by unknown processes, apply operating system privacy controls that require approval for screen recording, and restrict remote access tools. Collect endpoint telemetry centrally so a capture can be tied to the process and user behind it. On macOS and Windows, review which applications have been granted screen recording permission.\n\n**Signs to look for.** Look for unknown processes calling screen capture functions, image files created repeatedly in temp folders and screenshots being uploaded. A common gap is that legitimate tools also capture screens, so detection depends on knowing which processes are expected.","Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen`, `xwd`, or `screencapture`.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1113\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.664+00:00",{"total":9,"list":19},[20,24,28,32,36],{"slug":21,"title":22,"published_at":23},"china-linked-famoussparrow-targets-latin-american-governments-with-sparrowocky-backdoor","China-Linked FamousSparrow Targets Latin American Governments with SparroWocky Backdoor","2026-09-22T00:20:41.743+00:00",{"slug":25,"title":26,"published_at":27},"iranian-chosen-brick-malware-targets-dissidents-via-social-engineering","Iranian CHOSEN BRICK Malware Targets Dissidents via Social Engineering","2026-09-16T22:20:38.911+00:00",{"slug":29,"title":30,"published_at":31},"synkloader-multitool-signals-rising-ransomware-threat-via-screen-hijacking-malware","SynkLoader Multitool Signals Rising Ransomware Threat via Screen-Hijacking Malware","2026-08-24T16:20:34.049+00:00",{"slug":33,"title":34,"published_at":35},"mirage-kitten-apt-deploys-covert-backdoor-via-spear-phishing-lures","Mirage Kitten APT Deploys Covert Backdoor via Spear-Phishing Lures","2026-07-28T10:21:25.243+00:00",{"slug":37,"title":38,"published_at":39},"telepuz-malware-exploits-clickfix-social-engineering-to-steal-data","TELEPUZ Malware Exploits ClickFix Social Engineering to Steal Data","2026-07-16T14:21:24.639+00:00",[41,45,50,55,59,64],{"slug":42,"name":43,"problem":44,"stories":9},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":46,"name":47,"problem":48,"stories":49},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",4,{"slug":51,"name":52,"problem":53,"stories":54},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",2,{"slug":56,"name":57,"problem":58,"stories":54},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":60,"name":61,"problem":62,"stories":63},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",1,{"slug":65,"name":66,"problem":67,"stories":63},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[69,74,79,85,89,93,98,102],{"family":70,"item":71,"code":72,"title":73,"together":9},"nist-800-53","si-3","SI-3","Malicious Code Protection",{"family":75,"item":76,"code":77,"title":78,"together":49},"cis","14","Control 14","Security Awareness and Skills Training",{"family":80,"item":81,"code":82,"title":83,"together":84},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",3,{"family":75,"item":86,"code":87,"title":88,"together":84},"17","Control 17","Incident Response Management",{"family":75,"item":90,"code":91,"title":92,"together":84},"9","Control 9","Email and Web Browser Protections",{"family":94,"item":95,"code":96,"title":97,"together":84},"gdpr","32","Article 32","Security of processing",{"family":75,"item":99,"code":100,"title":101,"together":54},"3","Control 3","Data Protection",{"family":75,"item":103,"code":104,"title":105,"together":54},"2","Control 2","Inventory and Control of Software Assets"]