Cross-source coverage

T1123 / ATT&CK

Audio Capture

18 rules · 16 families across 4 sources.

From MITRE ATT&CK 19.2

An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information.

Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture audio. Audio files may be written to disk and exfiltrated later.

Tactics
Collection
Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:SysmonWinEventLog:Securityauditd:SYSCALLlinux:Sysmonmacos:unifiedlogApple TCC Logsfs:fsusage

How MITRE says to detect it DET0221

Behavioral Detection Strategy for T1123 Audio Capture Across Windows, Linux, macOS

Windows Analytic 0619

Unusual or unauthorized processes accessing microphone APIs (e.g., winmm.dll, avrt.dll) followed by audio file writes to user-accessible or temp directories.

  • WinEventLog:Sysmon EventCode=10
  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:Security EventCode=4688

Linux Analytic 0620

Processes accessing ALSA/PulseAudio devices or executing audio capture binaries like 'arecord', followed by file creation or suspicious child process spawning.

  • auditd:SYSCALL open
  • linux:Sysmon EventCode=1
  • auditd:SYSCALL write

macOS Analytic 0621

Processes invoking AVFoundation or CoreAudio frameworks, accessing input devices via TCC logs or Unified Logs, followed by writing AIFF/WAV/MP3 files to disk.

  • macos:unifiedlog audio APIs
  • Apple TCC Logs Microphone Access Events
  • fs:fsusage File IO

View on attack.mitre.org ↗

socfortress/Wazuh-Rules

7 rules · 5 families
Detection Severity Format
Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges. 2 variants High Wazuh XML
Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges. 2 variants High Wazuh XML
Detects attempts to record audio with arecord utility. 2 variants High Wazuh XML
Detects attempts to record audio with arecord utility. 2 variants High Wazuh XML
Sysmon - Event 12: RegistryEvent (Object create and delete) by · Audio Capture (T1123) Low Wazuh XML
Sysmon - Event 13: RegistryEvent (Value Set) by · Audio Capture (T1123) Low Wazuh XML
Sysmon - Event 14: RegistryEvent (Key and Value Rename) by · Audio Capture (T1123) Low Wazuh XML

SigmaHQ/sigma

6 rules
Detection Severity Format
OpenCanary - SIP Request High Sigma
Suspicious Camera and Microphone Access High Sigma
Audio Capture via PowerShell Medium Sigma
Audio Capture via SoundRecorder Medium Sigma
Processes Accessing the Microphone and Webcam Medium Sigma
Audio Capture Low Sigma

splunk/security_content

3 rules
Detection Severity Format
Zoom Rare Audio Devices Undefined SPL
Zoom Rare Input Devices Undefined SPL
Zoom Rare Video Devices Undefined SPL

elastic/detection-rules

2 rules
Detection Severity Format
PowerShell Suspicious Script with Audio Capture Capabilities High Elastic TOML
Linux Audio Recording Activity Detected Low Elastic TOML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.