Collection Screen Capture T1513 Used to take screenshot on the device Exfiltration Standard Application Layer Protocol T1437 Used Standard HTTP Protocol Command and Control Uncommonly Used Port T1509 Used uncommon ports 2000, 3000