T1113 — Screen Capture

Tactic: Collection · Platforms: Linux, macOS, Windows

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through…

Sigma detection rules (3)

T1113 Screen Capture

title: T1113 Screen Capture
id: 719b425d-a7be-433d-90e6-1f99bda07160
description: 'Detects use of the .NET CopyFromScreen API or command-line screenshot utilities (e.g. nircmd savescreenshot) to capture the desktop (the previous version also matched Get-Clipboard, which reads clipboard text/image data -- Clipboard Data, T1115 -- not a screen capture). Tune using: ParentProcessName, TimeWindow, ImageExtension.'
references:
  - https://attack.mitre.org/techniques/T1113
author: Shahrukh Khan
date: 2026-03-05
license: MIT
tags:
  - attack.collection
  - attack.t1113

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_dotnet:
    CommandLine|contains: 'CopyFromScreen'
  selection_nircmd:
    Image|endswith: '\nircmd.exe'
    CommandLine|contains: 'savescreenshot'

  condition: 1 of selection_*

falsepositives:
  - Legitimate screenshot-utility automation scripts (e.g. QA/test automation, remote-support tooling) using CopyFromScreen or nircmd.

level: medium

T1113 Screen Capture

title: T1113 Screen Capture
id: f559b028-08af-4194-9c6b-8f351cdb6cf0
description: 'Detect Screen Capture via Commands and API Calls. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TerminalSession, ExecutablePath.'
references:
  - https://attack.mitre.org/techniques/T1113
author: Shahrukh Khan
date: 2026-05-12
license: MIT
tags:
  - attack.collection
  - attack.t1113

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/scrot'
      - '/import'
      - '/gnome-screenshot'
      - '/maim'

  condition: selection

falsepositives:
  - Screenshot utilities are legitimately used by users and remote-support/help-desk tooling on desktop Linux hosts; expect noise on workstation fleets, less so on headless servers.

level: medium

T1113 Screen Capture

title: T1113 Screen Capture
id: 09f0a7fe-2e82-4327-a162-8684350bf538
description: 'Detect Screen Capture via Commands and API Calls. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CommandLineRegex, ParentProcessName.'
references:
  - https://attack.mitre.org/techniques/T1113
author: Shahrukh Khan
date: 2026-01-19
license: MIT
tags:
  - attack.collection
  - attack.t1113

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/screencapture'
    ParentImage|endswith:
      - '/osascript'
      - '/python3'

  condition: selection

falsepositives:
  - Legitimate screenshot utilities and automated QA scripts invoke screencapture the same way.

level: medium

Explore