Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Захват экрана

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.(Citation: CopyFromScreen .NET)(Citation: Antiquated Mac Malware)

ID: T1113

Тактика(-и): Collection

Платформы: Linux, macOS, Windows

Источники данных: Command: Command Execution, Process: OS API Execution

Версия: 1.1

Дата создания: 31 May 2017

Последнее изменение: 30 Mar 2023

Название	Описание
Примеры процедур
Pteranodon	Pteranodon can capture screenshots at a configurable interval.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: Unit 42 Gamaredon February 2022)
GRIFFON	GRIFFON has used a screenshot module that can be used to take a screenshot of the remote system.(Citation: SecureList Griffon May 2019)
JHUHUGIT	A JHUHUGIT variant takes screenshots by simulating the user pressing the "Take Screenshot" key (VK_SCREENSHOT), accessing the screenshot saved in the clipboard, and converting it to a JPG image.(Citation: Unit 42 Playbook Dec 2017)(Citation: Talos Seduploader Oct 2017)
Agent Tesla	Agent Tesla can capture screenshots of the victim’s desktop.(Citation: Talos Agent Tesla Oct 2018)(Citation: DigiTrust Agent Tesla Jan 2017)(Citation: Fortinet Agent Tesla April 2018)(Citation: Fortinet Agent Tesla June 2017)(Citation: Bitdefender Agent Tesla April 2020)
Dragonfly	Dragonfly has performed screen captures of victims, including by using a tool, scr.exe (which matched the hash of ScreenUtil).(Citation: US-CERT TA18-074A)(Citation: Symantec Dragonfly Sept 2017)(Citation: Gigamon Berserk Bear October 2021)
Pupy	Pupy can drop a mouse-logger that will take small screenshots around at each click and then send back to the server.(Citation: GitHub Pupy)
TURNEDUP	TURNEDUP is capable of taking screenshots.(Citation: FireEye APT33 Sept 2017)
Trojan.Karagany	Trojan.Karagany can take a desktop screenshot and save the file into `\ProgramData\Mail\MailAg\shot.png`.(Citation: Symantec Dragonfly)(Citation: Secureworks Karagany July 2019)
FinFisher	FinFisher takes a screenshot of the screen and displays it on top of all other windows for few seconds in an apparent attempt to hide some messages showed by the system during the setup process.(Citation: FinFisher Citation)(Citation: Microsoft FinFisher March 2018)
Cobian RAT	Cobian RAT has a feature to perform screen capture.(Citation: Zscaler Cobian Aug 2017)
BADNEWS	BADNEWS has a command to take a screenshot and send it to the C2 server.(Citation: Forcepoint Monsoon)(Citation: PaloAlto Patchwork Mar 2018)
Ramsay	Ramsay can take screenshots every 30 seconds as well as when an external removable storage device is connected.(Citation: Antiy CERT Ramsay April 2020)
BlackEnergy	BlackEnergy is capable of taking screenshots.(Citation: Securelist BlackEnergy Nov 2014)
Carbanak	Carbanak performs desktop video recording and captures screenshots of the desktop and sends it to the C2 server.(Citation: FireEye CARBANAK June 2017)
ObliqueRAT	ObliqueRAT can capture a screenshot of the current screen.(Citation: Talos Oblique RAT March 2021)
Clambling	Clambling has the ability to capture screenshots.(Citation: Trend Micro DRBControl February 2020)
PcShare	PcShare can take screen shots of a compromised machine.(Citation: Bitdefender FunnyDream Campaign November 2020)
Empire	Empire is capable of capturing screenshots on Windows and macOS systems.(Citation: Github PowerShell Empire)
Mispadu	Mispadu has the ability to capture screenshots on compromised hosts.(Citation: SCILabs Malteiro 2021)(Citation: SCILabs URSA/Mispadu Evolution 2023)(Citation: ESET Security Mispadu Facebook Ads 2019)(Citation: Metabase Q Mispadu Trojan 2023)
CrossRAT	CrossRAT is capable of taking screen captures.(Citation: Lookout Dark Caracal Jan 2018)
Prikormka	Prikormka contains a module that captures screenshots of the victim's desktop.(Citation: ESET Operation Groundbait)
BRONZE BUTLER	BRONZE BUTLER has used a tool to capture screenshots.(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)
BISCUIT	BISCUIT has a command to periodically take screenshots of the system.(Citation: Mandiant APT1 Appendix)
MacMa	MacMa has used Apple’s Core Graphic APIs, such as `CGWindowListCreateImageFromArray`, to capture the user's screen and open windows.(Citation: ESET DazzleSpy Jan 2022)(Citation: Objective-See MacMa Nov 2021)
BADHATCH	BADHATCH can take screenshots and send them to an actor-controlled C2 server.(Citation: BitDefender BADHATCH Mar 2021)
njRAT	njRAT can capture screenshots of the victim’s machines.(Citation: Trend Micro njRAT 2018)
Turian	Turian has the ability to take screenshots.(Citation: ESET BackdoorDiplomacy Jun 2021)
Gamaredon Group	Gamaredon Group's malware can take screenshots of the compromised computer every minute.(Citation: ESET Gamaredon June 2020)
Cannon	Cannon can take a screenshot of the desktop.(Citation: Unit42 Cannon Nov 2018)
Zebrocy	A variant of Zebrocy captures screenshots of the victim’s machine in JPEG and BMP format.(Citation: Unit42 Cannon Nov 2018)(Citation: ESET Zebrocy Nov 2018)(Citation: Unit42 Sofacy Dec 2018)(Citation: ESET Zebrocy May 2019)(Citation: Accenture SNAKEMACKEREL Nov 2018)(Citation: CISA Zebrocy Oct 2020)
TajMahal	TajMahal has the ability to take screenshots on an infected host including capturing content from windows of instant messaging applications.(Citation: Kaspersky TajMahal April 2019)
Cobalt Strike	Cobalt Strike's Beacon payload is capable of capturing screenshots.(Citation: cobaltstrike manual)(Citation: Amnesty Intl. Ocean Lotus February 2021)(Citation: Cobalt Strike Manual 4.3 November 2020)
SharpStage	SharpStage has the ability to capture the victim's screen.(Citation: Cybereason Molerats Dec 2020)(Citation: BleepingComputer Molerats Dec 2020)
InvisiMole	InvisiMole can capture screenshots of not only the entire screen, but of each separate window open, in case they are overlapping.(Citation: ESET InvisiMole June 2018)(Citation: ESET InvisiMole June 2020)
OilRig	OilRig has a tool called CANDYKING to capture a screenshot of user's desktop.(Citation: FireEye APT34 Webinar Dec 2017)
APT28	APT28 has used tools to take screenshots from victims.(Citation: ESET Sednit Part 2)(Citation: XAgentOSX 2017)(Citation: DOJ GRU Indictment Jul 2018)(Citation: Secureworks IRON TWILIGHT Active Measures March 2017)
RedLeaves	RedLeaves can capture screenshots.(Citation: FireEye APT10 April 2017)(Citation: Accenture Hogfish April 2018)
SILENTTRINITY	SILENTTRINITY can take a screenshot of the current desktop.(Citation: GitHub SILENTTRINITY Modules July 2019)
RDAT	RDAT can take a screenshot on the infected system.(Citation: Unit42 RDAT July 2020)
Zeus Panda	Zeus Panda can take screenshots of the victim’s machine.(Citation: GDATA Zeus Panda June 2017)
ZxShell	ZxShell can capture screenshots.(Citation: FireEye APT41 Aug 2019)
MoustachedBouncer	MoustachedBouncer has used plugins to take screenshots on targeted systems.(Citation: MoustachedBouncer ESET August 2023)
POORAIM	POORAIM can perform screen capturing.(Citation: FireEye APT37 Feb 2018)
RCSession	RCSession can capture screenshots from a compromised host.(Citation: Profero APT27 December 2020)
UPPERCUT	UPPERCUT can capture desktop screenshots in the PNG format and send them to the C2 server.(Citation: FireEye APT10 Sept 2018)
Brute Ratel C4	Brute Ratel C4 can take screenshots on compromised hosts.(Citation: Palo Alto Brute Ratel July 2022)
GOLD SOUTHFIELD	GOLD SOUTHFIELD has used the remote monitoring and management tool ConnectWise to obtain screen captures from victim's machines.(Citation: Tetra Defense Sodinokibi March 2020)
LitePower	LitePower can take system screenshots and save them to `%AppData%`.(Citation: Kaspersky WIRTE November 2021)
BadPatch	BadPatch captures screenshots in .jpg format and then exfiltrates them.(Citation: Unit 42 BadPatch Oct 2017)
Aria-body	Aria-body has the ability to capture screenshots on compromised hosts.(Citation: CheckPoint Naikon May 2020)
Cuckoo Stealer	Cuckoo Stealer can run `screencapture` to collect screenshots from compromised hosts. (Citation: Kandji Cuckoo April 2024)
Valak	Valak has the ability to take screenshots on a compromised host.(Citation: Cybereason Valak May 2020)
DUSTTRAP	DUSTTRAP can capture screenshots.(Citation: Google Cloud APT41 2024)
Rover	Rover takes screenshots of the compromised system's desktop and saves them to `C:\system\screenshot.bmp` for exfiltration every 60 minutes.(Citation: Palo Alto Rover)
Lizar	Lizar can take JPEG screenshots of an infected system.(Citation: Threatpost Lizar May 2021)(Citation: BiZone Lizar May 2021)
Magic Hound	Magic Hound malware can take a screenshot and upload the file to its C2 server.(Citation: Unit 42 Magic Hound Feb 2017)
Peppy	Peppy can take screenshots on targeted systems.(Citation: Proofpoint Operation Transparent Tribe March 2016)
Daserf	Daserf can take screenshots.(Citation: Trend Micro Daserf Nov 2017)(Citation: Secureworks BRONZE BUTLER Oct 2017)
TinyZBot	TinyZBot contains screen capture functionality.(Citation: Cylance Cleaver)
MuddyWater	MuddyWater has used malware that can capture screenshots of the victim’s machine.(Citation: Securelist MuddyWater Oct 2018)
Crimson	Crimson contains a command to perform screen captures.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)
Winter Vivern	Winter Vivern delivered PowerShell scripts capable of taking screenshots of victim machines.(Citation: CERT-UA WinterVivern 2023)
CHOPSTICK	CHOPSTICK has the capability to capture screenshots.(Citation: DOJ GRU Indictment Jul 2018)
ZLib	ZLib has the ability to obtain screenshots of the compromised system.(Citation: Cylance Dust Storm)
CosmicDuke	CosmicDuke takes periodic screenshots and exfiltrates them.(Citation: F-Secure Cosmicduke)
Attor	Attor's has a plugin that captures screenshots of the target applications.(Citation: ESET Attor Oct 2019)
Silence	Silence can capture victim screen activity.(Citation: SecureList Silence Nov 2017)(Citation: Group IB Silence Sept 2018)
metaMain	metaMain can take and save screenshots.(Citation: SentinelLabs Metador Sept 2022)(Citation: SentinelLabs Metador Technical Appendix Sept 2022)
Volt Typhoon	Volt Typhoon has obtained a screenshot of the victim's system using the gdi32.dll and gdiplus.dll libraries.(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)
SVCReady	SVCReady can take a screenshot from an infected host.(Citation: HP SVCReady Jun 2022)
PowerSploit	PowerSploit's `Get-TimedScreenshot` Exfiltration module can take screenshots at regular intervals.(Citation: GitHub PowerSploit May 2012)(Citation: PowerSploit Documentation)
Flame	Flame can take regular screenshots when certain applications are open that are sent to the command and control server.(Citation: Kaspersky Flame)
StrifeWater	StrifeWater has the ability to take screen captures.(Citation: Cybereason StrifeWater Feb 2022)
VERMIN	VERMIN can perform screen captures of the victim’s machine.(Citation: Unit 42 VERMIN Jan 2018)
Manjusaka	Manjusaka can take screenshots of the victim desktop.(Citation: Talos Manjusaka 2022)
Ursnif	Ursnif has used hooked APIs to take screenshots.(Citation: TrendMicro Ursnif Mar 2015)(Citation: TrendMicro BKDR_URSNIF.SM)
Cobalt Strike	Cobalt Strike's "beacon" payload is capable of capturing screenshots.(Citation: cobaltstrike manual)
Woody RAT	Woody RAT has the ability to take a screenshot of the infected host desktop using Windows GDI+.(Citation: MalwareBytes WoodyRAT Aug 2022)
LookBack	LookBack can take desktop screenshots.(Citation: Proofpoint LookBack Malware Aug 2019)
ECCENTRICBANDWAGON	ECCENTRICBANDWAGON can capture screenshots and store them locally.(Citation: CISA EB Aug 2020)
Mafalda	Mafalda can take a screenshot of the target machine and save it to a file.(Citation: SentinelLabs Metador Sept 2022)
Kivars	Kivars has the ability to capture screenshots on the infected host.(Citation: TrendMicro BlackTech June 2017)
Sliver	Sliver can take screenshots of the victim’s active display.(Citation: GitHub Sliver Screen)
DOGCALL	DOGCALL is capable of capturing screenshots of the victim's machine.(Citation: FireEye APT37 Feb 2018)(Citation: Unit 42 Nokki Oct 2018)
Group5	Malware used by Group5 is capable of watching the victim's screen.(Citation: Citizen Lab Group5)
SysUpdate	SysUpdate has the ability to capture screenshots.(Citation: Trend Micro Iron Tiger April 2021)
HyperBro	HyperBro has the ability to take screenshots.(Citation: Unit42 Emissary Panda May 2019)
FunnyDream	The FunnyDream ScreenCap component can take screenshots on a compromised host.(Citation: Bitdefender FunnyDream Campaign November 2020)
APT39	APT39 has used a screen capture utility to take screenshots on a compromised host.(Citation: Symantec Chafer February 2018)(Citation: FBI FLASH APT39 September 2020)
Chrommme	Chrommme has the ability to capture screenshots.(Citation: ESET Gelsemium June 2021)
FruitFly	FruitFly takes screenshots of the user's desktop.(Citation: objsee mac malware 2017)
Remcos	Remcos takes automated screenshots of the infected machine.(Citation: Riskiq Remcos Jan 2018)
NightClub	NightClub can load a module to call `CreateCompatibleDC` and `GdipSaveImageToStream` for screen capture.(Citation: MoustachedBouncer ESET August 2023)
FlawedAmmyy	FlawedAmmyy can capture screenshots.(Citation: Korean FSI TA505 2020)
Matryoshka	Matryoshka is capable of performing screen captures.(Citation: ClearSky Wilted Tulip July 2017)(Citation: CopyKittens Nov 2015)
Raccoon Stealer	Raccoon Stealer can capture screenshots from victim systems.(Citation: S2W Racoon 2022)(Citation: Sekoia Raccoon2 2022)
DustySky	DustySky captures PNG screenshots of the main screen.(Citation: Kaspersky MoleRATs April 2019)
Bandook	Bandook is capable of taking an image of and uploading the current desktop.(Citation: Lookout Dark Caracal Jan 2018)(Citation: CheckPoint Bandook Nov 2020)
Hydraq	Hydraq includes a component based on the code of VNC that can stream a live feed of the desktop of an infected host.(Citation: Symantec Hydraq Jan 2010)
RainyDay	RainyDay has the ability to capture screenshots.(Citation: Bitdefender Naikon April 2021)
Kasidet	Kasidet has the ability to initiate keylogging and screen captures.(Citation: Zscaler Kasidet)
KONNI	KONNI can take screenshots of the victim’s machine.(Citation: Talos Konni May 2017)
gh0st RAT	gh0st RAT can capture the victim’s screen remotely.(Citation: Nccgroup Gh0st April 2018)
Kazuar	Kazuar captures screenshots of the victim’s screen.(Citation: Unit 42 Kazuar May 2017)
EvilGrab	EvilGrab has the capability to capture screenshots.(Citation: PWC Cloud Hopper Technical Annex April 2017)
HALFBAKED	HALFBAKED can obtain screenshots from the victim.(Citation: FireEye FIN7 April 2017)
Metamorfo	Metamorfo can collect screenshots of the victim’s machine.(Citation: FireEye Metamorfo Apr 2018)(Citation: ESET Casbaneiro Oct 2019)
yty	yty collects screenshots of the victim machine.(Citation: ASERT Donot March 2018)
Micropsia	Micropsia takes screenshots every 90 seconds by calling the Gdi32.BitBlt API.(Citation: Radware Micropsia July 2018)
SMOKEDHAM	SMOKEDHAM can capture screenshots of the victim’s desktop.(Citation: FireEye Shining A Light on DARKSIDE May 2021)(Citation: FireEye SMOKEDHAM June 2021)
PlugX	PlugX allows the operator to capture screenshots.(Citation: CIRCL PlugX March 2013)
KeyBoy	KeyBoy has a command to perform screen grabbing.(Citation: PWC KeyBoys Feb 2017)
Socksbot	Socksbot can take screenshots.(Citation: TrendMicro Patchwork Dec 2017)
XAgentOSX	XAgentOSX contains the takeScreenShot (along with startTakeScreenShot and stopTakeScreenShot) functions to take screenshots using the CGGetActiveDisplayList, CGDisplayCreateImage, and NSImage:initWithCGImage methods.(Citation: XAgentOSX 2017)
KEYMARBLE	KEYMARBLE can capture screenshots of the victim’s machine.(Citation: US-CERT KEYMARBLE Aug 2018)
ConnectWise	ConnectWise can take screenshots on remote hosts.(Citation: Anomali Static Kitten February 2021)
LunarMail	LunarMail can capture screenshots from compromised hosts.(Citation: ESET Turla Lunar toolset May 2024)
ROKRAT	ROKRAT can capture screenshots of the infected system using the `gdi32` library.(Citation: Talos ROKRAT)(Citation: Talos ROKRAT 2)(Citation: Securelist ScarCruft May 2019)(Citation: NCCGroup RokRat Nov 2018)(Citation: Malwarebytes RokRAT VBA January 2021)
Revenge RAT	Revenge RAT has a plugin for screen capture.(Citation: Cylance Shaheen Nov 2018)
Derusbi	Derusbi is capable of performing screen captures.(Citation: FireEye Periscope March 2018)
NETWIRE	NETWIRE can capture the victim's screen.(Citation: McAfee Netwire Mar 2015)(Citation: FireEye NETWIRE March 2019)(Citation: Red Canary NETWIRE January 2020)(Citation: Proofpoint NETWIRE December 2020)
Proton	Proton captures the content of the desktop with the screencapture binary.(Citation: objsee mac malware 2017)
CHIMNEYSWEEP	CHIMNEYSWEEP can capture screenshots on targeted systems using a timer and either upload them or store them to disk.(Citation: Mandiant ROADSWEEP August 2022)
AppleSeed	AppleSeed can take screenshots on a compromised host by calling a series of APIs.(Citation: Malwarebytes Kimsuky June 2021)(Citation: KISA Operation Muzabi)
Dragonfly 2.0	Dragonfly 2.0 has performed screen captures of victims, including by using a tool, scr.exe (which matched the hash of ScreenUtil).(Citation: US-CERT TA18-074A)(Citation: Symantec Dragonfly Sept 2017)
Remexi	Remexi takes screenshots of windows of interest.(Citation: Securelist Remexi Jan 2019)
SHUTTERSPEED	SHUTTERSPEED can capture screenshots.(Citation: FireEye APT37 Feb 2018)
PoetRAT	PoetRAT has the ability to take screen captures.(Citation: Talos PoetRAT April 2020)(Citation: Dragos Threat Report 2020)
Cadelspy	Cadelspy has the ability to capture screenshots and webcam photos.(Citation: Symantec Chafer Dec 2015)
T9000	T9000 can take screenshots of the desktop and target application windows, saving them to user directories as one byte XOR encrypted .dat files.(Citation: Palo Alto T9000 Feb 2016)
CharmPower	CharmPower has the ability to capture screenshots.(Citation: Check Point APT35 CharmPower January 2022)
Carberp	Carberp can capture display screenshots with the screens_dll.dll plugin.(Citation: Prevx Carberp March 2011)
BLUELIGHT	BLUELIGHT has captured a screenshot of the display every 30 seconds for the first 5 minutes after initiating a C2 loop, and then once every five minutes thereafter.(Citation: Volexity InkySquid BLUELIGHT August 2021)
MacSpy	MacSpy can capture screenshots of the desktop over multiple monitors.(Citation: objsee mac malware 2017)
SLOTHFULMEDIA	SLOTHFULMEDIA has taken a screenshot of a victim's desktop, named it "Filter3.jpg", and stored it in the local directory.(Citation: CISA MAR SLOTHFULMEDIA October 2020)
RogueRobin	RogueRobin has a command named `$screenshot` that may be responsible for taking screenshots of the victim machine.(Citation: Unit 42 DarkHydrus July 2018)
Chaes	Chaes can capture screenshots of the infected machine.(Citation: Cybereason Chaes Nov 2020)
POWERSTATS	POWERSTATS can retrieve screenshots from compromised hosts.(Citation: FireEye MuddyWater Mar 2018)(Citation: TrendMicro POWERSTATS V3 June 2019)
jRAT	jRAT has the capability to take screenshots of the victim’s machine.(Citation: jRAT Symantec Aug 2018)(Citation: Kaspersky Adwind Feb 2016)
RemoteUtilities	RemoteUtilities can take screenshots on a compromised host.(Citation: Trend Micro Muddy Water March 2021)
Dark Caracal	Dark Caracal took screenshots using their Windows malware.(Citation: Lookout Dark Caracal Jan 2018)
POWRUNER	POWRUNER can capture a screenshot from a victim.(Citation: FireEye APT34 Dec 2017)
AsyncRAT	AsyncRAT has the ability to view the screen on compromised hosts.(Citation: AsyncRAT GitHub)
Azorult	Azorult can capture screenshots of the victim’s machines.(Citation: Unit42 Azorult Nov 2018)
HotCroissant	HotCroissant has the ability to do real time screen viewing on an infected host.(Citation: Carbon Black HotCroissant April 2020)
StoneDrill	StoneDrill can take screenshots.(Citation: Kaspersky StoneDrill 2017)
Catchamas	Catchamas captures screenshots based on specific keywords in the window’s title.(Citation: Symantec Catchamas April 2018)
NKAbuse	NKAbuse can take screenshots of the victim machine.(Citation: NKAbuse SL)
FIN7	FIN7 captured screenshots and desktop video recordings.(Citation: DOJ FIN7 Aug 2018)
Cardinal RAT	Cardinal RAT can capture screenshots.(Citation: PaloAlto CardinalRat Apr 2017)
XCSSET	XCSSET saves a screen capture of the victim's system with a numbered filename and `.jpg` extension. Screen captures are taken at specified intervals based on the system. (Citation: trendmicro xcsset xcode project 2020)
Octopus	Octopus can capture screenshots of the victims’ machine.(Citation: Securelist Octopus Oct 2018)(Citation: Security Affairs DustSquad Oct 2018)(Citation: ESET Nomadic Octopus 2018)
RTM	RTM can capture screenshots.(Citation: ESET RTM Feb 2017)(Citation: Unit42 Redaman January 2019)
QuietSieve	QuietSieve has taken screenshots every five minutes and saved them to the user's local Application Data folder under `Temp\SymbolSourceSymbols\icons` or `Temp\ModeAuto\icons`.(Citation: Microsoft Actinium February 2022)
Machete	Machete captures screenshots.(Citation: ESET Machete July 2019)(Citation: Securelist Machete Aug 2014)(Citation: Cylance Machete Mar 2017)(Citation: 360 Machete Sep 2020)
Janicab	Janicab captured screenshots and sent them out to a C2 server.(Citation: f-secure janicab)(Citation: Janicab)
MarkiRAT	MarkiRAT can capture screenshots that are initially saved as ‘scr.jpg’.(Citation: Kaspersky Ferocious Kitten Jun 2021)

Контрмера	Описание
Контрмеры
Screen Capture Mitigation	Blocking software based on screen capture functionality may be difficult, and there may be legitimate software that performs those actions. Instead, identify potentially malicious software that may have functionality to acquire screen captures, and audit and/or block it by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)

Обнаружение

Monitoring for screen capture behavior will depend on the method used to obtain data from the operating system and write output files. Detection methods could include collecting information from unusual processes using API calls used to obtain image data, and monitoring for image files written to disk. The sensor data may need to be correlated with other events to identify malicious activity, depending on the legitimacy of this behavior within a given network environment.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.

Захват экрана

Примеры процедур

Контрмеры

Обнаружение

Ссылки

Связанные риски

Каталоги