Processes Accessing the Microphone and Webcam

Status: test
Severity: medium
Log source: product windows, service security
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Source: github.com/SigmaHQ/sigma

Potential adversaries accessing the microphone and webcam in an endpoint.

MITRE ATT&CK coverage

Tactic	Techniques
Collection	`T1123` Audio Capture

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4656: A handle to an object was requested.
Security-Auditing	Event ID 4657: A registry value was modified.
Security-Auditing	Event ID 4663: An attempt was made to access an object.

Rule body

title: Processes Accessing the Microphone and Webcam
id: 8cd538a4-62d5-4e83-810b-12d41e428d6e
status: test
description: Potential adversaries accessing the microphone and webcam in an endpoint.
references:
    - https://twitter.com/duzvik/status/1269671601852813320
    - https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
date: 2020-06-07
modified: 2021-11-27
tags:
    - attack.collection
    - attack.t1123
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID:
            - 4657
            - 4656
            - 4663
        ObjectName|contains:
            - '\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged'
            - '\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged'
    condition: selection
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    EventID:
        - 4657
        - 4656
        - 4663
    ObjectName|contains:
        - '\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged'
        - '\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ObjectName`	match	`\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged` `\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged`	`field:"ObjectName" kind:match`

Processes Accessing the Microphone and Webcam

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Stage 0: `condition`

Stage 1: `selection`