Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0346 — Detect Screen Capture via Commands and API Calls
DET0346

Detect Screen Capture via Commands and API Calls

3 analytic(s) · 1 technique(s) detected

Analytics

3
AN0980 Analytic 0980
Windows

Unusual use of screen capture APIs (e.g., CopyFromScreen) or command-line tools to write image files to disk.

WinEventLog:Sysmon EventCode=1 WinEventLog:Sysmon EventCode=7
[ParentProcessName] Depends on allowed parent process behaviors in the environment (e.g., explorer.exe vs powershell.exe)
[TimeWindow] Can tune alert thresholds for rapid or scheduled screenshots (e.g., interval-based screen capture)
[ImageExtension] To detect file writes (e.g., .bmp, .png) that deviate from typical user activity
AN0981 Analytic 0981
macOS

Invocation of built-in commands like screencapture or use of undocumented APIs from suspicious parent processes.

macos:unifiedlog process: exec
[CommandLineRegex] Customize regex for flag detection (e.g., `screencapture -x`) based on usage patterns
[ParentProcessName] May vary depending on expected screencapture behavior (Terminal vs remote agent)
AN0982 Analytic 0982
Linux

Use of tools like xwd or import to generate screenshots, especially under non-GUI parent processes.

auditd:SYSCALL execve
[TerminalSession] Filter based on TTY sessions or remote terminal usage
[ExecutablePath] Match against known location of xwd/import binaries or renamed variants

Detected Techniques

1

Collection (1)

Details

MITRE ID
DET0346
STIX ID
x-mitre-detection-strategy--a9de0990-69e9-4b1a-9754-1c7fb4102ac9
Analytics
3
Techniques Detected
1
By Tactic
Collection
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.