Screen Capture

Technique · ATTACK:ics:T0852

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:ics:T0852",
  "title": "Screen Capture",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T0852",
  "snapshot": "ics-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--c5e3cdbc-0387-4be9-8f83-ff5c0865f377",
  "external_id": "T0852",
  "domain": "ics",
  "created": "2020-05-21T17:43:26.506Z",
  "modified": "2026-10-13T17:48:40.879Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [
    "collection"
  ],
  "source_references": [
    {
      "source_name": "ICS-CERT October 2017",
      "url": "https://www.us-cert.gov/ncas/alerts/TA17-293A"
    }
  ]
}

Explicit source assertions (4)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:ics:G0064 → uses → ATTACK:ics:T0852

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0beb0088-3bea-4612-b2d9-ff9988f829ae

Jacqueline O'Leary et al. September 2017 · Junnosuke Yagi March 2017

ATTACK:ics:G1000 → uses → ATTACK:ics:T0852

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5424e327-396f-4b07-94a3-408ffc915686

Dragos · ICS-CERT October 2017

ATTACK:ics:C0063 → uses → ATTACK:ics:T0852

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57abea59-09c3-496f-a6b9-21c6a0cb9b7a

CERT Polska

ATTACK:ics:M0816 → mitigates → ATTACK:ics:T0852

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b5e52859-8dab-4e7e-af70-bb38c6993c98

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.