Common Information
Type Value
Value
Screen Capture - T1113
Category Attack-Pattern
Type Mitre-Enterprise-Attack-Attack-Pattern
Misp Type Cluster
Description Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. ===Mac=== On OSX, the native command <code>screencapture</code> is used to capture screenshots. ===Linux=== On Linux, there is the native command <code>xwd</code>. (Citation: Antiquated Mac Malware) Detection: Monitoring for screen capture behavior will depend on the method used to obtain data from the operating system and write output files. Detection methods could include collecting information from unusual processes using API calls used to obtain image data, and monitoring for image files written to disk. The sensor data may need to be correlated with other events to identify malicious activity, depending on the legitimacy of this behavior within a given network environment. Platforms: Linux, macOS, Windows Data Sources: API monitoring, Process monitoring, File monitoring
Details Published Attributes CTI Title
Details Website 2023-04-10 12 March 2023’s Most Wanted Malware: New Emotet Campaign Bypasses Microsoft Blocks to Distribute Malicious OneNote Files - Check Point Software
Details Website 2023-04-05 0 OBS now blocks rogue Windows DLL files, gets improved AV1 support on AMD and Nvidia
Details Website 2023-04-04 5 Out of Band NTLM Relay Using Outlook CVE-2023–23397 Vulnerability
Details Website 2023-03-28 0 Advanced Presistent Threat(APT)
Details Website 2023-03-28 32 Anomali Cyber Watch: Bitter Spies on Chinese Nuclear Energy, Kimsuky Takes Over Google Account to Infect Connected Android Devices, Bad Magic APT Targets Occupied Parts of Ukraine
Details Website 2023-03-24 398 Threat Roundup for March 17 to March 24
Details Website 2023-03-24 0 The ‘Acropalypse,’ Chat GPT’s GPT-4, CISA 's Critical Infrastructure Advisories and More
Details Website 2023-03-23 1 The dangers of unmonitored community activities.
Details Website 2023-03-23 68 Cinoshi Project and the Dark Side of Free MaaS
Details Website 2023-03-16 121 Not‑so‑private messaging: Trojanized WhatsApp and Telegram apps go after cryptocurrency wallets | WeLiveSecurity
Details Website 2023-03-16 252 Peeking at Reaper’s surveillance operations
Details Website 2023-03-14 59 The slow Tick‑ing time bomb: Tick APT group compromise of a DLP software developer in East Asia | WeLiveSecurity
Details Website 2023-03-14 36 Anomali Cyber Watch: Xenomorph Automates The Whole Fraud Chain on Android, IceFire Ransomware Started Targeting Linux, Mythic Leopard Delivers Spyware Using Romance Scam
Details Website 2023-03-13 0 Remcos Trojan back on Check Point’s top 10 list of global threats | IT World Canada News
Details Website 2023-03-09 11 February 2023’s Most Wanted Malware: Remcos Trojan Linked to Cyberespionage Operations Against Ukrainian Government - Check Point Software
Details Website 2023-03-03 20 Monthly Threat Actor Group Intelligence Report, January 2023 (KOR) – Red Alert
Details Website 2023-03-02 0 Fortinet is Named a Visionary in the Gartner® Magic Quadrant™ for Endpoint Protection Platforms | Fortinet Blog
Details Website 2023-03-02 199 Russia/Ukraine Update - February 2023
Details Website 2023-03-01 5 Hunting for Suspicious Windows Libraries for Execution and Defense Evasion — Elastic Security Labs
Details Website 2023-03-01 1 Two Hacking Groups Seen Targeting Materials Sector in Asia
Details Website 2023-02-25 5 Five Cybersecurity Threats Affecting Businesses in February 2023 | Marcum LLP | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware - National Cyber Security
Details Website 2023-02-21 8 Built-in macOS Security Tools
Details Website 2023-02-20 215 Stealc: a copycat of Vidar and Raccoon infostealers gaining in popularity - Part 1
Details Website 2023-02-17 49 The Many Faces of Qakbot Malware: A Look at Its Diverse Distribution Methods
Details Website 2023-02-13 261 Dalbit (m00nlight): Chinese Hacker Group's APT Attack Campaign - ASEC BLOG