T1113 Screen Capture

Technique: T1113
Tactics: Collection
Research, 90 days: 7
KEV CVEs mapped: 0
SigmaHQ rules: 10
Elastic, Splunk: 8
thrunt rules: 0
Active families: Remcos
Upstream: https://attack.mitre.org/techniques/T1113

MITRE description

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or <code>screencapture</code>.(Citation: CopyFromScreen .NET)(Citation: Antiquated Mac Malware)

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-10-30 Darktrace: CikaBika Bot: Inside a Discord RAT Campaign
2026-10-22 ESET: MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration
2026-10-22 Group-IB: Inside SiriusQT: A Seriously Skilled RAT
2026-10-14 Group-IB: KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize
2026-10-02 Group-IB: Anatomía de BraZetsu: Cómo los cibercriminales abastecen el ecosistema clandestino
2026-09-17 ESET: Beware the SparroWock: The backdoor that bites, the commands that catch
2026-08-31 Group-IB: Anatomy of BraZetsu: How Cybercriminals Fuel the Underground Ecosystem

Detection coverage

SigmaHQ community rules

System Drawing DLL Load (threat-hunting)
Screen Capture with Import Tool (core)
Screen Capture with Xwd (core)
Screen Capture - macOS (core)
Windows Screen Capture with CopyFromScreen (core)
Screen Capture Activity Via Psr.EXE (core)
Windows Recall Feature Enabled Via Reg.EXE (core)
Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted (core)
Periodic Backup For System Registry Hives Enabled (core)
Windows Recall Feature Enabled - Registry (core)

Elastic and Splunk rules

Linux Video Recording or Screenshot Activity Detected (elastic)
PowerShell Suspicious Script with Screenshot Capabilities (elastic)
Potential Remote Desktop Shadowing Activity (elastic)
Remcos RAT File Creation in Remcos Folder (splunk)
Suspicious Image Creation In Appdata Folder (splunk)
Suspicious WAV file in Appdata Folder (splunk)
Windows Screen Capture in TEMP folder (splunk)
Windows Screen Capture Via Powershell (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.