Screen Capture (T1113) is how an infostealer or RAT grabs what it cannot read from disk: whatever is on the victim's monitor when the process fires, from a crypto wallet balance to an open password manager. Windows offers three cheap paths, .NET's CopyFromScreen, the GDI BitBlt call, or the built-in Psr.exe recorder, and the resulting image usually lands in a temp folder seconds before it is exfiltrated.
Practice detecting Screen Capture on realistic SIEM, XDR alerts in SOCSimulator Operations.
“Screen Capture is documented as technique T1113 in MITRE ATT&CK® v19.1 under the Collection tactic. Detection requires visibility into SIEM, XDR telemetry.”
On Windows, the cheapest path is .NET's Graphics.CopyFromScreen, three lines of code that copy the primary display's device context into a bitmap object, which is why it shows up constantly in PowerShell-based stealers and commodity RATs: no compiled binary is needed, just a script block loading System.Drawing. The lower-level equivalent is the GDI pair GetDC plus BitBlt, which native malware favors because it avoids spinning up the .NET runtime and leaves a smaller footprint. Either way the output is a raw bitmap that the malware then encodes to PNG or JPEG, usually with GdipSaveImageToStream, before it touches disk.
A second, quieter path abuses what is already installed: Psr.exe, the Windows Problem Steps Recorder, ships signed on every modern Windows box and will record the screen (plus mouse clicks) to an MHTML file when launched with /start. Because it is a legitimate Microsoft binary, it passes most application allow-lists that would block an unknown screenshot utility outright, and it has been used this way since at least 2019 per the LOLBAS project.
On the infostealer side, the pattern is mechanical rather than interactive: the malware fires once on execution or on a timer, saves the capture as screenshot.png, screenshot.jpg, or screenshot.bmp into %TEMP% or a similarly writable path, bundles it with harvested browser data and wallet files, and ships the archive to C2 within seconds. Linux and macOS variants use xwd against the root window or the native screencapture utility respectively, but the Windows temp-drop pattern is by far the most common in commodity stealer families.
Screen capture almost never opens an intrusion. It arrives after execution, typically as one module in a larger infostealer or RAT payload that has already run Deobfuscate/Decode Files or Information (T1140) to unpack itself and established persistence or a C2 channel. The screenshot is collection, not access: it exists to grab context a file-grabber alone would miss, an unlocked crypto wallet interface, a two-factor code on screen, an open chat session.
Splunk's Security Content team built the temp-folder detection specifically off StealC Stealer and Braodo Stealer behavior, both of which pair T1113 with browser credential theft, clipboard hijacking, and wallet-file harvesting in the same run before exfiltrating everything as one archive over the C2 channel (T1041). That is the exact chain SOCSimulator's free StealC room walks through: a fake game-cheat tool masquerades as a legitimate download, drops a stealer that captures the desktop alongside clipboard data and keystrokes, and exfiltrates the loot before a cryptojacker installs for the long haul. Seeing a screenshot artifact land in temp is frequently the first externally-visible sign that the rest of that chain is already underway.
The following detection strategies help SOC analysts identify Screen Capture activity. These methods apply across SIEM, XDR environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.
logsource:
product: windows
category: ps_script
detection:
selection:
ScriptBlockText|contains: '.CopyFromScreen'
condition: selectionSigmaHQ's 'Windows Screen Capture with CopyFromScreen' rule, matching PowerShell script blocks that call the .NET Graphics.CopyFromScreen method most script-based stealers and RATs use to grab the desktop.
logsource:
product: windows
category: process_creation
detection:
selection:
Image|endswith: '\\Psr.exe'
CommandLine|contains:
- '/start'
- '-start'
condition: selectionSigmaHQ's 'Screen Capture Activity Via Psr.EXE' rule, catching the built-in Problem Steps Recorder started with an activation flag, a signed LOLBin attackers use precisely because it rarely appears on an application allow-list.
Timestamp: 2026-07-16T03:14:22.777Z
DeviceName: WKS-042.corp.local
FileName: powershell.exe
ProcessCommandLine: powershell.exe -nop -w hidden -c "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen"
ScriptBlockText: [Reflection.Assembly]::LoadWithPartialName('System.Drawing'); $bmp.Graphics.CopyFromScreen(0,0,0,0,$bmp.Size)
InitiatingProcessFileName: gamecheat_setup.exe
AccountName: jmartinez| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
FROM datamodel=Endpoint.Filesystem
where Filesystem.file_name IN ("screenshot.png", "screenshot.jpg", "screenshot.bmp")
Filesystem.file_path = "*\\temp\\*"
by Filesystem.dest Filesystem.file_path Filesystem.file_name Filesystem.process_guid Filesystem.process_id Filesystem.user
| `drop_dm_object_name(Filesystem)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`Mirrors Splunk Security Content's 'Windows Screen Capture in TEMP Folder' analytic, which was written specifically for StealC and Braodo stealer and fires on Sysmon EventID 11 filesystem events naming a screenshot dropped into a temp path.
EventID: 11
UtcTime: 2026-07-16 03:14:22.501
Image: C:\Users\jmartinez\AppData\Local\Temp\gamecheat_setup.exe
TargetFilename: C:\Users\jmartinez\AppData\Local\Temp\screenshot.png
CreationUtcTime: 2026-07-16 03:14:22.480
User: WKS-042\jmartinezLegitimate remote-support and screen-recording software calls the exact same APIs. Help-desk tools, screen-recording and tutorial software, accessibility utilities for visually impaired users, and QA/testing frameworks that capture UI state all invoke CopyFromScreen or BitBlt as core functionality, and Psr.exe itself is a supported Microsoft troubleshooting tool IT staff use deliberately. None of that is malicious.
The fix is context, not the API call. Build an allow-list of the remote-support and screen-recording tools your organization actually deploys, and treat CopyFromScreen or Psr.exe usage from anything outside that set, especially an unsigned or newly-dropped binary, as the signal worth chasing. On the SIEM side, a screenshot.png in temp created by a known imaging or backup agent is routine maintenance; the same filename created by a process with no prior execution history on that host, immediately followed by an outbound connection, is the combination that actually separates a stealer from a support session.
These realistic alert examples show what Screen Capture looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.
Sysmon Event ID 11 recorded screenshot.png created in C:\Users\jmartinez\AppData\Local\Temp\ by an unsigned process masquerading as a game-cheat installer, seconds before the same process opened a connection to an unfamiliar external IP. Matches the StealC/Braodo temp-folder capture pattern.
Script Block Logging captured a PowerShell one-liner loading System.Windows.Forms and calling Graphics.CopyFromScreen on WKS-042, with no ticket for a sanctioned remote-support session. The host has no history of PowerShell-based screen capture.
psr.exe /start /gui 0 executed on a finance workstation, spawned by explorer.exe rather than a remote-support tool. Psr.exe is a signed Windows utility, so this activity would pass most application allow-lists while still recording the desktop.
When this fires, first identify the process that captured the screen and whether it is on your sanctioned remote-support or recording allow-list. If it is a known tool, confirm there is an open ticket or session record and close the alert. If it is not, pull the file's signature status, its parent process, and how it arrived on the host, since a masquerading installer (a fake cheat tool, cracked software, or a phishing attachment) is the most common delivery vector for stealers that ship a screen-capture module.
Treat an unrecognized screenshot artifact paired with outbound network activity as active collection-and-exfiltration, not a curiosity. Check whether the same process also touched browser credential stores, clipboard data, or cryptocurrency wallet files, since infostealers bundle all of it into one archive before shipping it to C2. If wallet or credential exposure is plausible, isolate the host, rotate any credentials that were visible on screen or stored in browser profiles, and treat crypto wallets accessed from that machine as compromised until proven otherwise, since a screenshot can leak a seed phrase or private key that no password rotation can undo.
Investigate Screen Capture on realistic SIEM, XDR, and firewall consoles, free.
Data exfiltration is the unauthorized transfer of sensitive data out of a victim environment to attacker-controlled infr…
Read more GlossaryData Loss Prevention (DLP) is a set of technologies and policies that detect and prevent unauthorized transmission, stor…
Read more GlossarySecurity Information and Event Management (SIEM) is a platform that aggregates, normalizes, and correlates log data from…
Read more GlossaryLog management is the process of collecting, normalizing, storing, retaining, and analyzing log data from across the IT …
Read more Career PathDFIR Analysts combine forensic investigation with incident response. You collect and analyze digital evidence from compr…
Read more Career PathIncident Responders lead the technical response when confirmed breaches happen. You coordinate containment, run forensic…
Read more ToolThe SIEM console in SOCSimulator replicates the workflow of enterprise platforms like Splunk Enterprise Security, Micros…
Read more ToolThe XDR console in SOCSimulator replicates the investigation workflow of platforms like CrowdStrike Falcon, Microsoft De…
Read more ComparisonSOCSimulator wins on operational realism. You get multi-tool shift simulation with SLA pressure, noise injection, and al…
Read more GlossaryComplete glossary of Security Operations Center terminology for aspiring SOC analysts.
Read more FeaturePractice alert triage under realistic time pressure with SLA timers and noise injection.
Read more FeatureStructured CTF-style investigation operations covering real-world attack scenarios.
Read more