Video Capture T1125
Tactic: Collection
An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files.
Events covered
8 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 12 | RegistryEvent (Object create and delete) |
| Sysmon | Event ID 13 | RegistryEvent (Value Set) |
| Sysmon | Event ID 14 | RegistryEvent (Key and Value Rename) |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| TerminalServices-RemoteConnectionManager | Event ID 20503 | Shadow View Session Started. |
| TerminalServices-RemoteConnectionManager | Event ID 20504 | Shadow View Session Stopped. |
| TerminalServices-RemoteConnectionManager | Event ID 20508 | Shadow View Permission Granted. |
Authoring guide
These 10 rules share fields, values, and exclusions.
Fields filtered most (14 distinct)
These fields appear most often in rule filters.
Top indicator values (65 distinct)
These values appear most often in rule predicates.
Exclusions (7 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 4 rules
- RDP shadow session configuration enabled (registry)
- RDP shadow session started (command)
- RDP shadow session started (native)
- Suspicious Camera and Microphone Access
Elastic 2 rules
- Linux Video Recording or Screenshot Activity Detected
- PowerShell Script with Webcam Video Capture Capabilities