# screencapture

> Capture a screenshot from command line.

A tools that allows users to take screenshots of their desktop or specific app windows. The tool can be used by malicious actors to collect sensitive information from the targeted system.

- Page: https://loobins.io/binaries/screencapture/
- Author: Brendan Chamberlain (@infosecB)
- Created: 2023-04-27
- Tactics: Collection

## Paths

- `/usr/sbin/screencapture`

## Example Use Cases

### Continuously capture screenshots

The following command demonstrates how an attacker can use the tool to capture screenshots every 10 seconds. The -x flag prevents snapshot sounds from being played.

```bash
while true; do ts=$(date +"%Y%m%d-%H%M%S"); o="/tmp/screenshots"; screencapture -x "$o/ss-$ts.png"; sleep 10; done
```

- Tactics: Collection
- Tags: oneliner

## Detections

- [Sigma: Screen Capture - macOS](https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_screencapture.yml)

## Resources

- [SS64 screencapture man page](https://ss64.com/osx/screencapture.html)