Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or <code>screencapture</code>.12
- CopyFromScreen .NET
- Antiquated Mac Malware
使用该技术的组织
| 组织 | 名称 | 国家 |
|---|---|---|
| grp_g0043 | Group5 | — |
| grp_g0070 | Dark Caracal | — |
| grp_g1035 | Winter Vivern | — |
| grp_g0115 | GOLD SOUTHFIELD | — |
| grp_g0035 | Dragonfly | Russia |
| grp_g1019 | MoustachedBouncer | — |
| grp_g1044 | APT42 | Iran |
| grp_g0049 | OilRig | Iran |
| grp_g0069 | MuddyWater | — |
| grp_g1055 | VOID MANTICORE | — |
| grp_g1017 | Volt Typhoon | — |
| grp_g0091 | Silence | — |
| grp_g0046 | FIN7 | — |
| grp_g0087 | APT39 | — |
| grp_g0047 | Gamaredon Group | Russia |
| grp_g0094 | Kimsuky | DPRK |
| grp_g0059 | Magic Hound | Iran |
| grp_g0060 | BRONZE BUTLER | — |
| grp_g0007 | APT28 | Russia |
断言
尚无指向该技术的公开断言。
记录自动入库·未人工复核；置信度与有效期按引用读取。