MITRE ATT&CK technique
Screen Capture detection rulesT1113
Screen Capture (T1113) is a MITRE ATT&CK technique in the Collection tactic. This page lists the 10 community-maintained Sigma detection rules in the library mapped to T1113 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows, linux, macos.
Tactic
Periodic Backup For System Registry Hives Enabled
mediumDetects the enabling of the "EnablePeriodicBackup" registry value. Once enabled, The OS will backup System registry hives on restarts to the "C:\Windows\System32\config\RegBack" folder. Windows creates a "RegIdleBackup" task to manage subsequent backups. Registry backup was a default behavior on Windows and was disabled as of "Windows 10, version 1803".
windows · registry_set
Screen Capture Activity Via Psr.EXE
mediumDetects execution of Windows Problem Steps Recorder (psr.exe), a utility used to record the user screen and clicks.
windows · process_creation
Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted
mediumDetects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" registry value. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.
windows · registry_delete
Windows Recall Feature Enabled - Registry
mediumDetects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by setting the value of "DisableAIDataAnalysis" to "0". Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.
windows · registry_set
Windows Recall Feature Enabled Via Reg.EXE
mediumDetects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" value, or setting it to 0. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.
windows · process_creation
Windows Screen Capture with CopyFromScreen
mediumAdversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations
windows · ps_script
Screen Capture - macOS
lowDetects attempts to use screencapture to collect macOS screenshots
macos · process_creation
Screen Capture with Import Tool
lowDetects adversary creating screen capture of a desktop with Import Tool. Highly recommended using rule on servers, due to high usage of screenshot utilities on user workstations. ImageMagick must be installed.
linux
Screen Capture with Xwd
lowDetects adversary creating screen capture of a full with xwd. Highly recommended using rule on servers, due high usage of screenshot utilities on user workstations
linux
System Drawing DLL Load
lowDetects processes loading "System.Drawing.ni.dll". This could be an indicator of potential Screen Capture.
windows · image_load