I've always been amazed about the sheer amount of service ProcMon can provide, but the topic on detecting screenshots being taken in general remains unexplored for me. If the programs I`m using on a daily basis are maliciously taking screenshots of my screen--and I've good reasons to believe they are--what's the way to detect such behaviour?

  • 1
    Don't know the for-certain answer, but this question is probably a good place to start: stackoverflow.com/questions/35163909/… Sep 18 '18 at 19:19
  • Also, Process Monitor is published by Microsoft and has access to the developers of and code comprising Windows. This alone would be sufficient capability, denied to any other utility, to create this feature. Sep 18 '18 at 19:21

I don't believe that Process Monitor is the tool for that. The reason is that it lists Windows messages and events, while taking a screenshot is done by calling API functions, chiefly the BitBlt function.

Only a product that hooks the necessary API calls of all the executing processes can detect taking screenshots, by detecting processes calling functions such as BitBlt while their windows are hidden, minimized, on the traybar or otherwise have no reason for doing it.

There is extensive information about API hooking available, for example
Windows API Hooking Tutorial (Example with DLL Injection).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.