MITRE ATT&CK technique
Audio Capture detection rulesT1123
Audio Capture (T1123) is a MITRE ATT&CK technique in the Collection tactic. This page lists the 6 community-maintained Sigma detection rules in the library mapped to T1123 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows, opencanary, linux.
Top products
Tactic
OpenCanary - SIP Request
highDetects instances where an SIP service on an OpenCanary node has had a SIP request.
opencanary · application
Suspicious Camera and Microphone Access
highDetects Processes accessing the camera and microphone from suspicious folder
windows · registry_event
Audio Capture via PowerShell
mediumDetects audio capture via PowerShell Cmdlet.
windows · process_creation
Audio Capture via SoundRecorder
mediumDetect attacker collecting audio via SoundRecorder application.
windows · process_creation
Processes Accessing the Microphone and Webcam
mediumPotential adversaries accessing the microphone and webcam in an endpoint.
windows
Audio Capture
lowDetects attempts to record audio using the arecord and ecasound utilities.
linux