BIOC
Informational
✕
Screen capture via command-line tool
Attackers may use the window system screen capture tool to collect screenshots.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Collection
- Status:
- Enabled
ATT&CK tactics: Collection (TA0009)
ATT&CK techniques: Screen Capture (T1113)
Indicator:
Process action type = execution AND target process name = xwd , xwud , import AND target process cmd = *-root* , *-in* , *-out* , *-window*
Preventable: yes