Audio Capture `T1123`

Tactic: Collection

An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information.

Events covered

10 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 12	RegistryEvent (Object create and delete)
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 14	RegistryEvent (Key and Value Rename)
Security-Auditing	Event ID 4656	A handle to an object was requested.
Security-Auditing	Event ID 4657	A registry value was modified.
Security-Auditing	Event ID 4663	An attempt was made to access an object.
Security-Auditing	Event ID 4688	A new process has been created.
Linux-Auditd	Event ID 1300	SYSCALL
Linux-Auditd	Event ID 1309	EXECVE

Authoring guide

These 11 rules share fields, values, and exclusions.

Fields filtered most (20 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`CommandLine`	2	`contains` 2	`/FILE`, `Get-AudioDevice` , `Set-AudioDevice` , `Toggle-AudioDevice`
`event.category`	2	`eq` 2	`process`
`EventType`	1	`in` 1	`exec`, `exec_event`, `start`
`Image`	1	`ends_with` 1	`\SoundRecorder.exe`
`ObjectName`	1	`contains` 1	`\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAcce...`, `\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAcce...`
`SYSCALL`	1	`eq` 1	`memfd_create`
`ScriptBlockText`	1	`eq` 1, `in` 1	`Get-AudioDevice`, `Get-MicrophoneAudio`, `Recording`
`TargetObject`	1	`contains` 1	`:#$Recycle.bin#`, `:#Temp#`, `:#Users#Default#`
`a0`	1	`eq` 1	`arecord`
`a1`	1	`eq` 1	`-vv`
`a2`	1	`eq` 1	`-fdat`
`camera`	1	`eq` 1	`*`
`event.type`	1	`eq` 1	`start`
`exe`	1	`ends_with` 1	`/ecasound`
`logtype`	1	`eq` 1	`15001`

Top indicator values (55 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.category`	`eq`	`process` elasticLinux Audio Recording Activity Detected elasticPowerShell Suspicious Script with Audio Capture Capabilities	2	105
`CommandLine`	`contains`	`/FILE` sigmaAudio Capture via SoundRecorder	1	2
`CommandLine`	`contains`	`Get-AudioDevice` sigmaAudio Capture via PowerShell	1
`CommandLine`	`contains`	`Set-AudioDevice` sigmaAudio Capture via PowerShell	1
`CommandLine`	`contains`	`Toggle-AudioDevice` sigmaAudio Capture via PowerShell	1
`CommandLine`	`contains`	`WindowsAudioDevice-Powershell-Cmdlet` sigmaAudio Capture via PowerShell	1
`CommandLine`	`contains`	`Write-AudioDevice` sigmaAudio Capture via PowerShell	1
`EventType`	`in`	`exec` elasticLinux Audio Recording Activity Detected	1	28
`EventType`	`in`	`exec_event` elasticLinux Audio Recording Activity Detected	1	17
`EventType`	`in`	`start` elasticLinux Audio Recording Activity Detected	1	13
`Image`	`ends_with`	`\SoundRecorder.exe` sigmaAudio Capture via SoundRecorder	1
`ObjectName`	`contains`	`\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentSto...` sigmaProcesses Accessing the Microphone and Webcam	1
`ObjectName`	`contains`	`\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentSto...` sigmaProcesses Accessing the Microphone and Webcam	1
`SYSCALL`	`eq`	`memfd_create` sigmaAudio Capture	1
`ScriptBlockText`	`eq`	`Get-AudioDevice` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`ScriptBlockText`	`eq`	`Get-MicrophoneAudio` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`ScriptBlockText`	`eq`	`Recording` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`ScriptBlockText`	`eq`	`Set-AudioDevice` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`ScriptBlockText`	`eq`	`WindowsAudioDevice-Powershell-Cmdlet` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`ScriptBlockText`	`eq`	`winmm.dll` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`ScriptBlockText`	`in`	`mciSendString` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`ScriptBlockText`	`in`	`mciSendStringA` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`ScriptBlockText`	`in`	`mciSendStringW` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`ScriptBlockText`	`in`	`waveInGetNumDevs` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`ScriptBlockText`	`in`	`waveInOpen` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`ScriptBlockText`	`in`	`waveInStart` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`TargetObject`	`contains`	`:#$Recycle.bin#` sigmaSuspicious Camera and Microphone Access	1
`TargetObject`	`contains`	`:#Temp#` sigmaSuspicious Camera and Microphone Access	1
`TargetObject`	`contains`	`:#Users#Default#` sigmaSuspicious Camera and Microphone Access	1
`TargetObject`	`contains`	`:#Users#Desktop#` sigmaSuspicious Camera and Microphone Access	1

Exclusions (11 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`camera`	`contains`	`FaceTime` splunkZoom Rare Audio Devices splunkZoom Rare Input Devices splunkZoom Rare Video Devices	3
`camera`	`contains`	`MacBook` splunkZoom Rare Audio Devices splunkZoom Rare Input Devices splunkZoom Rare Video Devices	3
`camera`	`contains`	`iPhone` splunkZoom Rare Audio Devices splunkZoom Rare Input Devices splunkZoom Rare Video Devices	3
`microphone`	`contains`	`MacBook Pro Microphone` splunkZoom Rare Audio Devices splunkZoom Rare Input Devices splunkZoom Rare Video Devices	3
`speaker`	`contains`	`AirPods` splunkZoom Rare Audio Devices splunkZoom Rare Input Devices splunkZoom Rare Video Devices	3
`ScriptBlockText`	`eq`	`PowerSploitIndicators` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`ScriptBlockText`	`eq`	`Set-PSBreakpoint` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`ScriptBlockText`	`eq`	`sentinelbreakpoints` elasticPowerShell Suspicious Script with Audio Capture Capabilities	1
`process.args`	`in`	`--help` elasticLinux Audio Recording Activity Detected	1
`process.args`	`in`	`--version` elasticLinux Audio Recording Activity Detected	1
`process.args`	`in`	`-h` elasticLinux Audio Recording Activity Detected	1

Audio Capture `T1123`

Events covered

Authoring guide

Fields filtered most (20 distinct)

Top indicator values (55 distinct)

Exclusions (11 distinct)

Rules under this technique

Sigma 6 rules

Elastic 2 rules

Splunk 3 rules

Audio Capture T1123

Events covered

Authoring guide

Fields filtered most (20 distinct)

Top indicator values (55 distinct)

Exclusions (11 distinct)

Rules under this technique

Sigma 6 rules

Elastic 2 rules

Splunk 3 rules

Audio Capture `T1123`