{"id":"T1123","name":"Audio Capture","url":"https://attack.mitre.org/techniques/T1123","tactics":["collection"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0221","stix_id":"x-mitre-detection-strategy--c7471b0b-ac10-4eac-aae6-cfa821e707dd","name":"Behavioral Detection Strategy for T1123 Audio Capture Across Windows, Linux, macOS","url":"https://attack.mitre.org/detectionstrategies/DET0221","analytics":[{"id":"AN0619","stix_id":"x-mitre-analytic--5aaad268-48fb-4826-9f68-b666e1b4a3bf","name":"Analytic 0619","description":"Unusual or unauthorized processes accessing microphone APIs (e.g., winmm.dll, avrt.dll) followed by audio file writes to user-accessible or temp directories.","url":"https://attack.mitre.org/detectionstrategies/DET0221#AN0619","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"}],"mutable_elements":[{"field":"TimeWindow","description":"Time span in which the process accesses audio APIs and writes files, to reduce false positives."},{"field":"TargetProcess","description":"Set of approved processes known to legitimately use microphone (e.g., Zoom, Teams)."},{"field":"WriteDirectory","description":"Allowlist of paths where legitimate apps store audio (e.g., user media folders)."}],"live":true,"detection_strategies":["DET0221"],"techniques":["T1123"]},{"id":"AN0620","stix_id":"x-mitre-analytic--3ac9b4c2-9137-4d20-9619-01029d656874","name":"Analytic 0620","description":"Processes accessing ALSA/PulseAudio devices or executing audio capture binaries like 'arecord', followed by file creation or suspicious child process spawning.","url":"https://attack.mitre.org/detectionstrategies/DET0221#AN0620","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"open","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-syscall"},{"name":"linux:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"linux-sysmon"},{"name":"auditd:SYSCALL","channel":"write","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"ExecutableName","description":"Capture binaries like arecord, parecord, or ffmpeg."},{"field":"DevicePath","description":"Log attempts to access /dev/snd/*, /dev/dsp, /proc/asound/*."},{"field":"UserContext","description":"Whether the user has audio access rights or is running under elevated privileges."}],"live":true,"detection_strategies":["DET0221"],"techniques":["T1123"]},{"id":"AN0621","stix_id":"x-mitre-analytic--f79a68ff-07f4-49ba-849b-9edb636f0b39","name":"Analytic 0621","description":"Processes invoking AVFoundation or CoreAudio frameworks, accessing input devices via TCC logs or Unified Logs, followed by writing AIFF/WAV/MP3 files to disk.","url":"https://attack.mitre.org/detectionstrategies/DET0221#AN0621","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"audio APIs","data_component":"DC0021","data_component_name":"OS API Execution","log_source_slug":"macos-unifiedlog"},{"name":"Apple TCC Logs","channel":"Microphone Access Events","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"apple-tcc-logs"},{"name":"fs:fsusage","channel":"File IO","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"fs-fsusage"}],"mutable_elements":[{"field":"FrameworkCall","description":"CoreAudio vs. AVFoundation vs. lower-level device access APIs."},{"field":"TargetDirectory","description":"Suspicious file drops (e.g., ~/Library/Caches/, /tmp/, nonstandard user folders)."},{"field":"AnomalousParent","description":"Unexpected parent-child relationship between non-media apps and AV capture."}],"live":true,"detection_strategies":["DET0221"],"techniques":["T1123"]}],"live":true,"version":"1.0","techniques":["T1123"]}],"sigma_rules":[{"id":"62120148-6b7a-42be-8b91-271c04e281a3","title":"Suspicious Camera and Microphone Access","author":"Den Iuzvyk","status":"test","level":"high","date":"2020-06-07","modified":"2022-10-09","description":"Detects Processes accessing the camera and microphone from suspicious folder","references":["https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072"],"logsource":{"product":"windows","category":"registry_event"},"tags":["attack.collection","attack.t1125","attack.t1123"],"path":"rules/windows/registry/registry_event/registry_event_susp_mic_cam_access.yml","techniques":["T1125","T1123"],"cves":[]},{"id":"83865853-59aa-449e-9600-74b9d89a6d6e","title":"Audio Capture via SoundRecorder","author":"E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community","status":"test","level":"medium","date":"2019-10-24","modified":"2021-11-27","description":"Detect attacker collecting audio via SoundRecorder application.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1123/T1123.md","https://eqllib.readthedocs.io/en/latest/analytics/f72a98cb-7b3d-4100-99c3-a138b6e9ff6e.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.collection","attack.t1123"],"path":"rules/windows/process_creation/proc_creation_win_soundrecorder_audio_capture.yml","techniques":["T1123"],"cves":[]},{"id":"8cd538a4-62d5-4e83-810b-12d41e428d6e","title":"Processes Accessing the Microphone and Webcam","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"medium","date":"2020-06-07","modified":"2021-11-27","description":"Potential adversaries accessing the microphone and webcam in an endpoint.","references":["https://twitter.com/duzvik/status/1269671601852813320","https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072"],"logsource":{"product":"windows","service":"security"},"tags":["attack.collection","attack.t1123"],"path":"rules/windows/builtin/security/win_security_camera_microphone_access.yml","techniques":["T1123"],"cves":[]},{"id":"932fb0d8-692b-4b0f-a26e-5643a50fe7d6","title":"Audio Capture via PowerShell","author":"E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2019-10-24","modified":"2023-04-06","description":"Detects audio capture via PowerShell Cmdlet.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1123/T1123.md","https://eqllib.readthedocs.io/en/latest/analytics/ab7a6ef4-0983-4275-a4f1-5c6bd3c31c23.html","https://github.com/frgnca/AudioDeviceCmdlets"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.collection","attack.t1123"],"path":"rules/windows/process_creation/proc_creation_win_powershell_audio_capture.yml","techniques":["T1123"],"cves":[]},{"id":"a7af2487-9c2f-42e4-9bb9-ff961f0561d5","title":"Audio Capture","author":"Pawel Mazur, Milad Cheraghi","status":"test","level":"low","date":"2021-09-04","modified":"2025-12-05","description":"Detects attempts to record audio using the arecord and ecasound utilities.","references":["https://linux.die.net/man/1/arecord","https://linuxconfig.org/how-to-test-microphone-with-audio-linux-sound-architecture-alsa","https://manpages.debian.org/unstable/ecasound/ecasound.1.en.html","https://ecasound.seul.org/ecasound/Documentation/examples.html#fconversions"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.collection","attack.t1123"],"path":"rules/linux/auditd/lnx_auditd_audio_capture.yml","techniques":["T1123"],"cves":[]},{"id":"e30de276-68ec-435c-ab99-ef3befec6c61","title":"OpenCanary - SIP Request","author":"Security Onion Solutions","status":"test","level":"high","date":"2024-03-08","modified":null,"description":"Detects instances where an SIP service on an OpenCanary node has had a SIP request.","references":["https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration","https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52"],"logsource":{"product":"opencanary","category":"application"},"tags":["attack.collection","attack.t1123"],"path":"rules/application/opencanary/opencanary_sip_request.yml","techniques":["T1123"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}