aol.pm

Screen Capture

Technique · ATTACK:mobile:T1513

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:mobile:T1513",
  "title": "Screen Capture",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1513",
  "snapshot": "mobile-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--73c26732-6422-4081-8b63-6d0ae93d449e",
  "external_id": "T1513",
  "domain": "mobile",
  "created": "2019-08-08T18:34:14.178Z",
  "modified": "2026-05-12T15:12:00.642Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [
    "collection"
  ],
  "source_references": [
    {
      "source_name": "Android ScreenCap2 2019",
      "url": "https://developer.android.com/studio/command-line/adb"
    },
    {
      "source_name": "Android ScreenCap1 2019",
      "url": "https://developer.android.com/reference/android/media/projection/MediaProjectionManager"
    },
    {
      "source_name": "Lookout-Monokle",
      "url": "https://www.lookout.com/documents/threat-reports/lookout-discovers-monokle-threat-report.pdf"
    },
    {
      "source_name": "Fortinet screencap July 2019",
      "url": "https://www.fortinet.com/blog/threat-research/new-wave-bianlian-malware.html"
    },
    {
      "source_name": "Trend Micro ScreenCap July 2015",
      "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/hacking-team-rcsandroid-spying-tool-listens-to-calls-roots-devices-to-get-in/"
    },
    {
      "source_name": "NIST Mobile Threat Catalogue",
      "url": "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-40.html",
      "external_id": "APP-40"
    }
  ]
}

Explicit source assertions (30)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:mobile:S0479 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a737289-c62d-4c0a-a857-6d116f774864

ESET DEFENSOR ID

ATTACK:mobile:S0408 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e2d1ffa-f6df-4d3c-b99b-f7b8baff53e8

FlexiSpy-Features

ATTACK:mobile:S1094 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e55d0cf-afe6-41f1-8ad3-0d1a910ad010

mcafee_brata_0421 · securelist_brata_0819

ATTACK:mobile:M1012 → mitigates → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e797961-356f-4763-bdb2-0ebc2ad4c8b0

ATTACK:mobile:S1082 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f41ab75-3490-4642-8111-9d4d43b88df7

lookout_hornbill_sunbird_0221

ATTACK:mobile:S1062 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38ec048f-7f6e-4bbd-9455-1b1e54968af4

cleafy_sova_1122

ATTACK:mobile:M1011 → mitigates → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42342d72-a37c-477e-b8f1-1768273fcb7f

ATTACK:mobile:S0489 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--430b2b14-9d63-401c-b76b-d0247ee7e27b

Talos-WolfRAT

ATTACK:mobile:S0324 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ced57a7-b674-40d4-98b8-a090963a6ade

PaloAlto-SpyDealer

ATTACK:mobile:S0407 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6556536c-d5ea-4a3d-ae48-4016d4d762ff

Lookout-Monokle

ATTACK:mobile:S0423 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--65803bfa-7601-44ad-95ea-64d8bfd778a4

ThreatFabric Ginp

ATTACK:mobile:S0485 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74eb8469-1cce-40f8-8b6b-486338e8cfbe

Bitdefender Mandrake

ATTACK:mobile:S1069 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--79ef0025-3e1c-4914-9873-19808c2a5bec

cloudmark_tanglebot_0921

ATTACK:mobile:S1083 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a06bcec-4d1a-4b50-89f8-36f145512050

ThreatFabric_Chameleon_Dec2023

ATTACK:mobile:S1054 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7ba4fb2e-99ff-41ff-8b07-f02e9f74e890

cyble_drinik_1022

ATTACK:mobile:S1079 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7bbbd2aa-104f-443a-907e-6e1fbcf0a73e

lookout_bouldspy_0423

ATTACK:mobile:S0558 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80ac52f9-ffa4-4b6e-b420-95d1b69ae9d9

Zscaler TikTok Spyware

ATTACK:mobile:S0422 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9814ecd5-911a-4776-9dc0-4a4ae0bf6a39

Cofense Anubis

ATTACK:mobile:S1077 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9b34ae1e-027f-4b52-9a4f-1e58f6efdc25

lookout_hornbill_sunbird_0221

ATTACK:mobile:S0478 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a32db277-593f-4fd1-bdcb-9f677b1a05e1

Cybereason EventBot

ATTACK:mobile:S1095 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a617fa0d-0dfc-432a-95f5-94ee4ae63860

welivesecurity_ahrat_0523

ATTACK:mobile:S0427 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b356d405-f6b1-485b-bd35-236b9da766d2

SecurityIntelligence TrickMo

ATTACK:mobile:S9004 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b7df5791-eff5-48f2-8111-1460d6066f53

ThreatFabric_Crocodilus_March2025

ATTACK:mobile:S1185 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cd1ad516-d953-40cb-b0d5-b384ceb410f2

LinkedIn Dmitry LightSpy 2025 · Threatfabric LightSpy 2024

ATTACK:mobile:S1195 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cd440baa-9989-486e-b34b-d9469ffc79a5

sophos_android_apt_spyware · welivesecurity_apt-c-23

ATTACK:mobile:S0551 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e03b25b0-0779-48da-b5d7-28f1f6106363

Lookout Uyghur Campaign

ATTACK:mobile:S0421 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e35b013b-89e8-41b3-a518-7737234ab71b

Trend Micro Bouncing Golf 2019

ATTACK:mobile:S0655 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eca02e5c-f8de-4436-a7dd-0f656c759a42

SecureList BusyGasper

ATTACK:mobile:M1013 → mitigates → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f9d0cfb5-aeda-4de4-9c72-7098297555ae

Nightwatch screencap April 2016

ATTACK:mobile:S0405 → uses → ATTACK:mobile:T1513

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fb3b32a8-6422-4d44-91e3-27a58e569963

SWB Exodus March 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.