AdversaryGraph public intelligence page

This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.

Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.

Main AdversaryGraph project Documentation Malware Analysis GitHub

T1113 · collection · 16 actors · 3 correlated reports

Screen Capture

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.

Open detection, hunting, mitigation, and evidence workspace

Detection logic

Monitoring for screen capture behavior will depend on the method used to obtain data from the operating system and write output files. Detection methods could include collecting information from unusual processes using API calls used to obtain image data, and monitoring for image files written to disk. The sensor data may need to be correlated with other events to identify malicious activity, depending on the legitimacy of this behavior within a given network environment.

Observed actors

Volt Typhoon
G1017 Dragonfly
G0035 MuddyWater
G0069 Gamaredon Group
G0047 FIN7
G0046 APT39
G0087 OilRig
G0049 MoustachedBouncer
G1019 Group5
G0043 Winter Vivern
G1035 Dark Caracal
G0070 BRONZE BUTLER
G0060 APT28
G0007 GOLD SOUTHFIELD
G0115 Silence
G0091 Magic Hound
G0059

Correlated CTI and IR reports

APT39 (Chafer / Remix Kitten)
Israel Threat Actors CTI · explicit report mention ATT&CK as a Working Tool: Theory and Hands-On Practical Usage
1200km CTI repository · explicit report mention ATT CK as a Working Tool Theory and Hands On Practical Usage
1200km Medium · authored report mention

Cyber Knowledge context

Use these routes to move from the ATT&CK behavior into explanation, implementation, evidence handling, validation, and defensive operations. Relevance is generated from explicit identifiers/names and governed topic mappings; it is not attribution evidence.

Module 4 — Collection Sources
Cyber Threat Intelligence (CTI) · Tactic learning route · 24/100 Endpoint live response and volatile acquisition
Digital Forensics & Incident Response (DFIR) · Tactic learning route · 24/100 Module 5 — Threat hunting
Blue Team & Defensive Security · Tactic learning route · 24/100

MITRE mitigations

No ATT&CK mitigation relationship is published for this technique. Apply risk-based controls and verify scope.

MITRE detection strategies and analytics

DET0346 · Detect Screen Capture via Commands and API Calls

AN0980 · Analytic 0980 — Unusual use of screen capture APIs (e.g., CopyFromScreen) or command-line tools to write image files to disk.
AN0981 · Analytic 0981 — Invocation of built-in commands like screencapture or use of undocumented APIs from suspicious parent processes.
AN0982 · Analytic 0982 — Use of tools like xwd or import to generate screenshots, especially under non-GUI parent processes.

MITRE detection source

Continue the investigation

Interactive AdversaryGraph AdversaryGraph documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas Insider Threat Detection Guide 1200km Medium research