Let me give background to my original question.
I have taken a screenshot using scripting via an HID attack and powershell. I'm not seeking responses regarding that, or on different ways to do that. A screenshot can be taken via HID, I have already established that and it's not a transparent attack. It cannot be done (starting the attack) whilst a person is using the machine, or while it's transitioning from locked to unlocked. Written HID attacks are very OS specific, you take screenshots differently on different OSes (and that's the easy part), saving the screenshot on the other hand is less trivial depending on the OS. As well, you cannot record video easily.
Is it feasible to create a USB Display Adapter ATTACKMODE ? That is, you plug in the Bunny and it pretends to be a secondary display adapter. Benefits being, as a PnP adapter, you can record screenshots or record video of activity WHILST is computer is in use. Presumptuously, the Bunny could be installed whilst the machine is locked and visually record activity from when the user unlocks it, till it's removed.
In the most basic form, the question is: how do you develop a custom ATTACKMODE module? Or, is that access only availble to Hak5?