CmdID

CmdID / Techniques

T1113 Screen Capture

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. MITRE ATT&CK

2 programs on CmdID 3 Sigma rules T1113 on attack.mitre.org

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

Sigma rules tagged with it

process creation, the highest levels first
mediumScreen Capture Activity Via Psr.EXEBeyu Denis, oscd.community · Windows
mediumWindows Recall Feature Enabled Via Reg.EXESajid Nawaz Khan · Windows
lowScreen Capture - macOSremotephone, oscd.community · macOS