ITM is an open framework - Submit your contributions now.

Insider Threat Matrix™Insider Threat Matrix™
  • ID: PR028.001
  • Created: 23rd June 2025
  • Updated: 23rd October 2025
  • Platforms: WindowsLinuxMacOS
  • MITRE ATT&CK®: T1113
  • Contributor: The ITM Team

Capture via Screenshot

The subject uses built-in or third-party tools to capture screenshots of sensitive data displayed on the screen. This may include financial records, source code, client information, internal chat transcripts, access credentials, or proprietary interfaces. Screenshot capture is often used as a low-friction means of data retention or transfer, especially in environments where traditional download or export functions are blocked, monitored, or leave visible artifacts.