Detection rules › Sigma

Suspicious Camera and Microphone Access

Severity
high
Author
Den Iuzvyk
Source
upstream

Detects Processes accessing the camera and microphone from suspicious folder

MITRE ATT&CK coverage

TacticTechniques
CollectionT1123 Audio Capture, T1125 Video Capture

Event coverage

ProviderEvent IDTitle
Sysmon12RegistryEvent (Object create and delete)
Sysmon13RegistryEvent (Value Set)
Sysmon14RegistryEvent (Key and Value Rename)

Stages and Predicates

Stage 1: all of selection_1

TargetObject|contains: '\NonPackaged'
TargetObject|contains: '\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\'

Stage 2: all of selection_2

or:
TargetObject|contains: microphone
TargetObject|contains: webcam

Stage 3: all of selection_3

or:
TargetObject|contains: ':#$Recycle.bin#'
TargetObject|contains: ':#Temp#'
TargetObject|contains: ':#Users#Default#'
TargetObject|contains: ':#Users#Desktop#'
TargetObject|contains: ':#Users#Public#'
TargetObject|contains: ':#Windows#Temp#'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
TargetObjectmatch
  • :#$Recycle.bin#
  • :#Temp#
  • :#Users#Default#
  • :#Users#Desktop#
  • :#Users#Public#
  • :#Windows#Temp#
  • \NonPackaged
  • \Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\
  • microphone
  • webcam