detection.wiki

Detection rules › Splunk

Windows Gather Victim Host Information Camera

Author
Teoderick Contreras, Splunk
Source
upstream

The following analytic detects a PowerShell script that enumerates camera devices on the targeted host. This detection leverages PowerShell Script Block Logging, specifically looking for commands querying Win32_PnPEntity for camera-related information. This activity is significant as it is commonly observed in DCRat malware, which collects camera data to send to its command-and-control server. If confirmed malicious, this behavior could indicate an attempt to gather sensitive visual information from the host, potentially leading to privacy breaches or further exploitation.

MITRE ATT&CK coverage

TacticTechniques
ReconnaissanceT1592.001 Gather Victim Host Information: Hardware

Event coverage

ProviderEvent IDTitle
PowerShell4104Creating Scriptblock text (MessageNumber of MessageTotal).

Stages and Predicates

Stage 1: search

search EventCode=4104 ScriptBlockText="* Win32_PnPEntity *" ScriptBlockText="*PNPClass*" ScriptBlockText="*SELECT*" ScriptBlockText="*WHERE*" ScriptBlockText IN ("*Camera*", "*Image*")

Stage 2: fillnull

fillnull

Stage 3: stats

stats BY dest, signature, signature_id, user_id, vendor_product, EventID, Guid, Opcode, Name, Path, ProcessID, ScriptBlockId, ScriptBlockText

Stage 4: search

search

Stage 5: search

search

Stage 6: search

search `macro`

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
EventCodeeq
  • 4104 corpus 108 (splunk 108)
ScriptBlockTexteq
  • "* Win32_PnPEntity *"
  • "*PNPClass*"
  • "*SELECT*" corpus 3 (splunk 3)
  • "*WHERE*"
ScriptBlockTextin
  • "*Camera*"
  • "*Image*"

Neighbors

Broader alternatives (more inclusive than this rule)

These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.