# T1113 - Screen Capture
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1113)
<blockquote>Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or <code>screencapture</code>.(Citation: CopyFromScreen .NET)(Citation: Antiquated Mac Malware)
</blockquote>

## Atomic Tests

- [Atomic Test #1 - Screencapture](#atomic-test-1---screencapture)

- [Atomic Test #2 - Screencapture (silent)](#atomic-test-2---screencapture-silent)

- [Atomic Test #3 - X Windows Capture](#atomic-test-3---x-windows-capture)

- [Atomic Test #4 - Capture Linux Desktop using Import Tool](#atomic-test-4---capture-linux-desktop-using-import-tool)

- [Atomic Test #5 - Windows Screencapture](#atomic-test-5---windows-screencapture)

- [Atomic Test #6 - Windows Screen Capture (CopyFromScreen)](#atomic-test-6---windows-screen-capture-copyfromscreen)


<br/>

## Atomic Test #1 - Screencapture
Use screencapture command to collect a full desktop screenshot

**Supported Platforms:** macOS


**auto_generated_guid:** 0f47ceb1-720f-4275-96b8-21f0562217ac





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| output_file | Output file path | Path | /tmp/T1113_desktop.png|


#### Attack Commands: Run with `bash`! 


```bash
screencapture #{output_file}
```

#### Cleanup Commands:
```bash
rm #{output_file}
```





<br/>
<br/>

## Atomic Test #2 - Screencapture (silent)
Use screencapture command to collect a full desktop screenshot

**Supported Platforms:** macOS


**auto_generated_guid:** deb7d358-5fbd-4dc4-aecc-ee0054d2d9a4





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| output_file | Output file path | Path | /tmp/T1113_desktop.png|


#### Attack Commands: Run with `bash`! 


```bash
screencapture -x #{output_file}
```

#### Cleanup Commands:
```bash
rm #{output_file}
```





<br/>
<br/>

## Atomic Test #3 - X Windows Capture
Use xwd command to collect a full desktop screenshot and review file with xwud

**Supported Platforms:** Linux


**auto_generated_guid:** 8206dd0c-faf6-4d74-ba13-7fbe13dce6ac





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| output_file | Output file path | Path | /tmp/T1113_desktop.xwd|
| package_checker | Package checking command for linux. Debian system command- dpkg -s x11-apps | String | rpm -q xorg-x11-apps|
| package_installer | Package installer command for linux. Debian system command- apt-get install x11-apps | String | yum install -y xorg-x11-apps|


#### Attack Commands: Run with `bash`! 


```bash
xwd -root -out #{output_file}
xwud -in #{output_file}
```

#### Cleanup Commands:
```bash
rm #{output_file}
```



#### Dependencies:  Run with `bash`!
##### Description: Package with XWD and XWUD must exist on device
##### Check Prereq Commands:
```bash
if #{package_checker} > /dev/null; then exit 0; else exit 1; fi
```
##### Get Prereq Commands:
```bash
sudo #{package_installer}
```




<br/>
<br/>

## Atomic Test #4 - Capture Linux Desktop using Import Tool
Use import command from ImageMagick to collect a full desktop screenshot

**Supported Platforms:** Linux


**auto_generated_guid:** 9cd1cccb-91e4-4550-9139-e20a586fcea1





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| output_file | Output file path | Path | /tmp/T1113_desktop.png|


#### Attack Commands: Run with `bash`! 


```bash
import -window root #{output_file}
```

#### Cleanup Commands:
```bash
rm #{output_file}
```



#### Dependencies:  Run with `bash`!
##### Description: ImageMagick must be installed
##### Check Prereq Commands:
```bash
if import -help > /dev/null 2>&1; then exit 0; else exit 1; fi
```
##### Get Prereq Commands:
```bash
sudo apt-get -y install graphicsmagick-imagemagick-compat
```




<br/>
<br/>

## Atomic Test #5 - Windows Screencapture
Use Psr.exe binary to collect screenshots of user display. Test will do left mouse click to simulate user behaviour

**Supported Platforms:** Windows


**auto_generated_guid:** 3c898f62-626c-47d5-aad2-6de873d69153





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| output_file | Output file path | Path | c:&#92;temp&#92;T1113_desktop.zip|
| recording_time | Time to take screenshots | String | 5|


#### Attack Commands: Run with `powershell`! 


```powershell
cmd /c start /b psr.exe /start /output #{output_file} /sc 1 /gui 0 /stopevent 12
Add-Type -MemberDefinition '[DllImport("user32.dll")] public static extern void mouse_event(int flags, int dx, int dy, int cButtons, int info);' -Name U32 -Namespace W;
[W.U32]::mouse_event(0x02 -bor 0x04 -bor 0x01, 0, 0, 0, 0);
cmd /c "timeout #{recording_time} > NULL && psr.exe /stop"
```

#### Cleanup Commands:
```powershell
rm #{output_file} -ErrorAction Ignore
```





<br/>
<br/>

## Atomic Test #6 - Windows Screen Capture (CopyFromScreen)
Take a screen capture of the desktop through a call to the [Graphics.CopyFromScreen] .NET API.

[Graphics.CopyFromScreen]: https://docs.microsoft.com/en-us/dotnet/api/system.drawing.graphics.copyfromscreen

**Supported Platforms:** Windows


**auto_generated_guid:** e9313014-985a-48ef-80d9-cde604ffc187





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| output_file | Path where captured results will be placed | Path | $env:TEMP&#92;T1113.png|


#### Attack Commands: Run with `powershell`! 


```powershell
Add-Type -AssemblyName System.Windows.Forms
$screen = [Windows.Forms.SystemInformation]::VirtualScreen
$bitmap = New-Object Drawing.Bitmap $screen.Width, $screen.Height
$graphic = [Drawing.Graphics]::FromImage($bitmap)
$graphic.CopyFromScreen($screen.Left, $screen.Top, 0, 0, $bitmap.Size)
$bitmap.Save("#{output_file}")
```

#### Cleanup Commands:
```powershell
Remove-Item #{output_file} -ErrorAction Ignore
```





<br/>
