Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or <code>screencapture</code>.12
- CopyFromScreen .NET
- Antiquated Mac Malware
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g0043 | Group5 | — |
| grp_g0070 | Dark Caracal | — |
| grp_g1035 | Winter Vivern | — |
| grp_g0115 | GOLD SOUTHFIELD | — |
| grp_g0035 | Dragonfly | Russia |
| grp_g1019 | MoustachedBouncer | — |
| grp_g1044 | APT42 | Iran |
| grp_g0049 | OilRig | Iran |
| grp_g0069 | MuddyWater | — |
| grp_g1055 | VOID MANTICORE | — |
| grp_g1017 | Volt Typhoon | — |
| grp_g0091 | Silence | — |
| grp_g0046 | FIN7 | — |
| grp_g0087 | APT39 | — |
| grp_g0047 | Gamaredon Group | Russia |
| grp_g0094 | Kimsuky | DPRK |
| grp_g0059 | Magic Hound | Iran |
| grp_g0060 | BRONZE BUTLER | — |
| grp_g0007 | APT28 | Russia |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.