Cross-source coverage

T1125 / ATT&CK

Video Capture

9 rules across 5 sources.

From MITRE ATT&CK 19.2

An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files.

Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture video or images. Video or image files may be written to disk and exfiltrated later. This technique differs from Screen Capture due to use of specific devices or applications for video recording rather than capturing the victim's screen.

In macOS, there are a few different malware samples that record the user's webcam such as FruitFly and Proton.

Tactics
Collection
Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:SysmonWinEventLog:SecurityWinEventLog:Microsoft-Windows-Windows Camera Frame Server/Operationalauditd:SYSCALLlinux:osquerylinux:syslogNSM:Flowmacos:unifiedlogmacos:endpointsecurity

How MITRE says to detect it DET0197

Behavior-chain, platform-aware detection strategy for T1125 Video Capture

Windows Analytic 0568

A non-standard process (or script-hosted process) loads camera/video-capture libraries (e.g., avicap32.dll, mf.dll, ksproxy.ax), opens the Camera Frame Server/device, writes video/image artifacts (e.g.,.mp4/.avi/.yuv) to unusual locations, and optionally initiates outbound transfer shortly after.

  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Sysmon EventCode=3, 22
  • WinEventLog:Sysmon EventCode=7
  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:Security EventCode=4663, 4670, 4656
  • WinEventLog:Microsoft-Windows-Windows Camera Frame Server/Operational Process session start/stop events for camera pipeline by unexpected executables

Linux Analytic 0569

A process opens/reads /dev/video* (V4L2), performs ioctl/read loops, writes large/continuous video artifacts to disk, and/or quickly establishes outbound connections for exfiltration.

  • auditd:SYSCALL openat/read/ioctl: openat/read/ioctl on /dev/video* by uncommon user/process
  • auditd:SYSCALL PATH records referencing /dev/video*
  • linux:osquery select: path LIKE '/dev/video%'
  • linux:syslog sudo execution of ffmpeg/gst-launch/v4l2-ctl by non-standard user
  • NSM:Flow http/file-xfer: Outbound transfer of large video-like MIME types soon after capture

macOS Analytic 0570

A non-whitelisted process receives TCC camera entitlement (kTCCServiceCamera), opens AppleCamera/AVFoundation device handles, writes.mov/.mp4 artifacts to unusual locations, and/or beacons/exfiltrates soon after.

  • macos:unifiedlog Access decisions to kTCCServiceCamera for unexpected binaries
  • macos:endpointsecurity open: Process opens AppleCamera/IOUSB device nodes or AVFoundation frameworks
  • macos:endpointsecurity exec: Exec of ffmpeg, avfoundation-based binaries, or custom signed apps accessing camera
  • macos:unifiedlog Process wrote large .mov/.mp4 in user temp/hidden dirs

View on attack.mitre.org ↗

socfortress/Wazuh-Rules

3 rules
Detection Severity Format
Sysmon - Event 12: RegistryEvent (Object create and delete) by · Video Capture (T1125) Low Wazuh XML
Sysmon - Event 13: RegistryEvent (Value Set) by · Video Capture (T1125) Low Wazuh XML
Sysmon - Event 14: RegistryEvent (Key and Value Rename) by · Video Capture (T1125) Low Wazuh XML

elastic/detection-rules

2 rules
Detection Severity Format
PowerShell Script with Webcam Video Capture Capabilities Medium Elastic TOML
Linux Video Recording or Screenshot Activity Detected Low Elastic TOML

splunk/security_content

2 rules
Detection Severity Format
Windows FFmpeg Audio and Video Device Discovery Undefined SPL
Windows FFmpeg DirectShow Video Capture Undefined SPL

SigmaHQ/sigma

1 rule
Detection Severity Format
Suspicious Camera and Microphone Access High Sigma

panther-labs/panther-analysis

1 rule
Detection Severity Format
Zoom Meeting Passcode Disabled Low Panther Python

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.