Detections
- ID: DT130
- Created: 23rd June 2025
- Updated: 23rd June 2025
- Platform: Windows
- Contributor: The ITM Team
Snipping Tool TempState\Snips
In Windows 11 the Snipping Tool utility, when the “Automatically save original screenshots” setting is manually toggled to disabled, will continue to save screenshots to the %LOCALAPPDATA%\Packages\Microsoft.ScreenSketch_8wekyb3d8bbwe\TempState\Snips directory. This is a fallback artifact from DT129 Snipping Tool Cached Screenshots. These PNG files use the naming convention Screenshot YYYY-MM-DD HHMMSS.png, helping to identify when they were captured, alongside the Created and Modified timestamps. This artifact can potentially provide an insight into activities conducted by the subject, such as data exfiltration via screenshots.
Sections
| ID | Name | Description |
|---|---|---|
| ME011 | Screenshots | A subject can take screenshots on a device. |
| PR028 | On-Screen Data Collection | The subject captures or records visual data displayed on their screen, including screenshots and screen recordings to extract sensitive or proprietary information. These actions are typically performed prior to an exfiltration infringement and serve as a method of data collection.
It is often used in contexts where the subject either lacks download privileges, seeks to avoid triggering detection systems, or wishes to discreetly capture transient data (e.g., internal dashboards, chat transcripts, or system output not written to disk). |
| PR028.001 | Capture via Screenshot | The subject uses built-in or third-party tools to capture screenshots of sensitive data displayed on the screen. This may include financial records, source code, client information, internal chat transcripts, access credentials, or proprietary interfaces. Screenshot capture is often used as a low-friction means of data retention or transfer, especially in environments where traditional download or export functions are blocked, monitored, or leave visible artifacts. |