Detection of Screen Capture

Monitor executed commands and arguments that may attempt to take screen captures of the desktop to gather information over the course of an operation.
Monitoring for screen capture behavior will depend on the method used to obtain data from the operating system and write output files. Detection methods could include collecting information from unusual processes using API calls used to obtain image data, and monitoring for image files written to disk, such as CopyFromScreen, xwd, or screencapture.^[1][2] The data may need to be correlated with other events to identify malicious activity, depending on the legitimacy of this behavior within a given network environment.