T1113

Description from ATT&CK

Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.(Citation: CopyFromScreen .NET)(Citation: Antiquated Mac Malware)

Tests

Test #1 - Take screenshot

Capture screenshot using System Events

tell application "System Events" to key code 20 using {command down, shift down}

Download Files

References

• MITRE ATT&CK T1113
• Apple Script Language Guide