---
{
  "title": "Screen Capture",
  "summary": "Screen capture collects what is visible on a user's display.",
  "topic": "soc",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    6
  ],
  "aliases": [
    "T1113"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1113: Screen Capture",
      "url": "https://attack.mitre.org/techniques/T1113"
    }
  ],
  "editorialVersion": 2
}
---

## Visible information can be collected as an image

Screen capture records information displayed on a user's screen. Operating systems, applications, remote-support tools, and other software can provide this capability. Unauthorized use may expose documents, messages, dashboards, or other information visible during the capture interval.

This differs from video captured through a camera. [[video-capture]] concerns peripheral devices or relevant applications, while screen capture focuses on the displayed desktop or application view. The distinction helps identify permissions, artifacts, and the potential information involved.

## An unexplained image appears

In a fictional endpoint case, a background process creates image files resembling the user's desktop at regular intervals. The analyst reviews the process, installation source, relevant permissions, file metadata, and any subsequent access or transfer.

An approved support session, accessibility feature, or documentation tool could explain the files. Check the user activity and responsible owner. A screenshot utility's presence alone does not establish unauthorized collection; its actual use and purpose matter.

If a capture artifact exists, handle it carefully. It may contain confidential business or personal information unrelated to the investigation. Restrict access and avoid redistributing the image in broadly visible tickets.

## Bound what was visible

A screen image shows content at a particular time and view. It does not establish every document stored on the device or every page the user visited. Multiple displays, minimized windows, locked sessions, and application behavior can affect what was captured.

A process event suggesting screen capture may not reveal whether an image was retained or what it contained. Separate the observed capability, invocation, artifact creation, and confirmed contents. [[logs-and-telemetry]] helps explain those evidence levels.

Review timing and any transfer records to determine whether captured material moved elsewhere. Image creation and [[exfiltration]] are separate stages; a network connection alone may not identify the transferred file.

## Stop unauthorized collection

Restrict the suspicious application or host as justified, preserve useful artifacts and records, and investigate how the component obtained access. Deleting existing images does not remove a process that continues capturing future activity.

Review exposed credentials or sensitive content according to the supported capture window. Do not assume every secret on the device was visible, and do not assume nothing sensitive was exposed because detailed capture records are missing.

For practice, compare an approved remote-support screenshot with a fictional unattended capture process. Identify consent or authorization, process provenance, interval, artifact, and transfer evidence. [[incident-response]] coordinates containment, while [[incident-reporting]] should distinguish observed capture from assumptions about retained content and external disclosure.

## Related concepts

- [[mitre-attack]]