Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or <code>screencapture</code>.(Citation: CopyFromScreen .NET)(Citation: Antiquated Mac Malware)
Use of tools like xwd or import to generate screenshots, especially under non-GUI parent processes.
Unusual use of screen capture APIs (e.g., CopyFromScreen) or command-line tools to write image files to disk.
Invocation of built-in commands like screencapture or use of undocumented APIs from suspicious parent processes.