T1113 Screen Capture — Detection Rules

Source-backed rule directory

• Screen Capture with Import Tool · test · low · {"product":"linux","service":"auditd"}
• Screen Capture with Xwd · test · low · {"product":"linux","service":"auditd"}
• Screen Capture - macOS · test · low · {"product":"macos","category":"process_creation"}
• Windows Screen Capture with CopyFromScreen · test · medium · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
• Screen Capture Activity Via Psr.EXE · test · medium · {"category":"process_creation","product":"windows"}
• Windows Recall Feature Enabled Via Reg.EXE · test · medium · {"category":"process_creation","product":"windows"}
• Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted · test · medium · {"category":"registry_delete","product":"windows"}
• Periodic Backup For System Registry Hives Enabled · test · medium · {"category":"registry_set","product":"windows"}
• Windows Recall Feature Enabled - Registry · test · medium · {"category":"registry_set","product":"windows"}

Atlas deterministic concepts

T1113 Screen Capture

MATCH(screen_capture_api_or_known_capture_tool) AND process NOT_IN approved_capture_apps -> ALERT

• Endpoint Detection and Response Telemetry
• Process Execution Logs
• Atlas source section

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0346 Detect Screen Capture via Commands and API Calls

AN0980 Analytic 0980

Unusual use of screen capture APIs (e.g., CopyFromScreen) or command-line tools to write image files to disk.

AN0981 Analytic 0981

Invocation of built-in commands like screencapture or use of undocumented APIs from suspicious parent processes.

AN0982 Analytic 0982

Use of tools like xwd or import to generate screenshots, especially under non-GUI parent processes.