Forensia CTI Core

About

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or <code>screencapture</code>.

Platforms: Linux, macOS, WindowsMITRE ATT&CK ↗

Used by actors

19 known groups

G0007 APT28 G0035 Dragonfly G0043 Group5 G0046 FIN7 G0047 Gamaredon Group G0049 OilRig G0059 Magic Hound G0060 BRONZE BUTLER G0069 MuddyWater G0070 Dark Caracal G0087 APT39 G0091 Silence G0094 Kimsuky G0115 GOLD SOUTHFIELD G1017 Volt Typhoon G1019 MoustachedBouncer G1035 Winter Vivern G1044 APT42 G1055 VOID MANTICORE

Software

151 malware/tools implement this

TinyZBotPlugXBISCUITDerusbiCHOPSTICKCarbanakgh0st RATJHUHUGITCosmicDukeDustySkyZLibKasidetBlackEnergyRoverTrojan.KaraganyT9000PrikormkaCrimsonBADNEWSFlamePteranodonRTMHALFBAKEDEvilGrabRedLeavesCobalt StrikeXAgentOSXJanicabMatryoshkaFinFisherPOWRUNERDaserfPupyPowerSploitNETWIRETURNEDUPHydraqDOGCALLPOORAIMSHUTTERSPEEDPOWERSTATSBandookCrossRATROKRATytyZebrocyVERMINInvisiMoleCatchamasKazuarRogueRobinKEYMARBLESocksbotUPPERCUTFruitFlyProtonMacSpyjRATZeus PandaAgent TeslaRemcosBadPatchCobian RATMicropsiaOctopusAzorultCardinal RATCannonKONNIEmpireRemexiRevenge RATStoneDrillFlawedAmmyynjRATUrsnifKeyBoyHyperBroMacheteZxShellGRIFFONPoetRATHotCroissantKivarsAttorCadelspyMetamorfoAria-bodyRamsayTajMahalValakCarberpRDATSLOTHFULMEDIASharpStageLookBackConnectWiseRemoteUtilitiesECCENTRICBANDWAGONAppleSeedRainyDayChaesSliverPeppyObliqueRATTurianSMOKEDHAMMarkiRATBLUELIGHTXCSSETClamblingRCSessionSysUpdateChrommmeCharmPowerLitePowerLizarQuietSieveSILENTTRINITYMacMaStrifeWaterFunnyDreamPcSharemetaMainMafaldaBrute Ratel C4SVCReadyWoody RATBADHATCHAsyncRATNightClubNKAbuseMispaduLunarMailRaccoon StealerCHIMNEYSWEEPCuckoo StealerManjusakaDUSTTRAPLightSpyTroll StealerTRANSLATEXTXLoaderQuick AssistLumma StealerHavocTONESHELLRedLine StealerHTTPTroyLODEINFOAshTag

Corpus indicators tagged with this technique

1,472 indicators in the corpus carry T1113.

Indicator	Type	Family	Sev	Src
cve-2026-3102	cve	—	85	3
e316b1e13154dc6115e1e0c023f6fe3d17861cae839d4a4a81779b6aad9a24f8	sha256	—	80	2
55d6238b01a177e25eb7d53c943f3abea64ec073	hash	phishing	80	2
b287347a5bff8af360ce0e6500c336b6fe6d97920abc26202c9d843ffebc5f89	sha256	—	80	2
3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be	sha256	ransomware	80	1
59e3c4cb06331b4f2d78a9a0592f3747e573bd01c5a7650c26361d1e25520712	sha256	ransomware	80	1
8c935feec4bd05d5d918df308be417532fb42608fb989a08eab183e0ae699235	sha256	ransomware	80	1
9e5b1e10ad6904d3f5b48d38470cd57263974640a27d13cf793ef026d3d6b886	hash	—	80	2
1a2ca8b8e0344fe3d80da7352206a470245443e2349a237bc093df934ddc011f	sha256	—	80	2
f591275a8f014b29e567529d67c54eb7bb4473db1c38737d6bfd5b3d52c9344e	sha256	ransomware	80	1
91e523a46f3bb860ac2e5800b7e1ec89d75a2408410b9cd25eebc17c8d7a92bc	hash	—	80	2
40b41979b317406f8abc601677a3b93aaf6ef8ab8ac188b8f383735e388f13b5	hash	—	80	3
6c6cbed6aad96564ed87094785be07a1	hash	phishing	80	2
fab69acd743f4111b749e3268690825c38822e62	hash	—	80	2
1682e8d82016b3f10434d2ebac995fd3b6aa812f079bfd7888652e94a994d851	sha256	—	80	2
61e9d76f07334843df561fe4bac449fb6fdaed5e5eb91480bded225f3d265c5f	hash	phishing	80	2
3e7066e44132e64360a30974b6ea3671	hash	—	80	3
34d798a6c55e57ed0932b6499f4fbcb5454bdfca903307be101a0594b0ac07bc	sha256	ransomware	80	1
99813f3d0625e880158c68039c0e2fbf488db0be3db77cd1ce6d382644193f0e	hash	—	80	2
606966a9ec33765baedf63331595d1168f2a596f	hash	—	80	3
03b51af0a04467cebfa235199db4c02e	hash	wallet_compromise	80	1
db972979d508e75fe730d3b72c2701470fbdaeaf8ebdd674744754fa44438ca5	sha256	ransomware	80	1
44f6101dd8171133f53317bfd752300e	hash	—	80	2
b90988400cced319d260c4937f334ecc364785ed5c593cd2139965e62ca58173	sha256	phishing	80	1
670384fafb23140d96f2f8fe04a13fc8cc8e2a6e5e8c973e39b58d103c5fea92	sha256	phishing	80	1
24398b75be2645e6c695e529e62e60deb418143a4bbea13c561d3c361419eb54	hash	—	80	2
3d510977d60a44322f88100b515f06cb5ed83babc64247068d1a489595faa6c5	sha256	phishing	80	1
07cd03e2082bcb0b890cc59ce4c770d1a095ac6f1ae9cf999f5542555c56f841	sha256	phishing	80	1
e20b35a8c30e076cdd0e1df05ba1ff2e418dbd39a674f084787cc0af2fda9e95	sha256	phishing	80	1
d3fd32f915c239872c9e7ed9408b1f36dfcef03aa68f9a396d05c437667cdb43	sha256	—	80	2

Showing the top 30 by severity of 1,472.