Technique.View on attack.mitre.org
An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information.
Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture audio. Audio files may be written to disk and exfiltrated later.
Rules on DetectionCode tagged with T1123.
| Rule | Level | Log source |
|---|---|---|
| OpenCanary - SIP Request | high | opencanary / application |
| Suspicious Camera and Microphone Access | high | windows / registry_event |
| Audio Capture via PowerShell | medium | windows / process_creation |
| Audio Capture via SoundRecorder | medium | windows / process_creation |
| Processes Accessing the Microphone and Webcam | medium | windows / NULL |
| Audio Capture | low | linux / NULL |
| Rule | Type | Risk | Data source |
|---|---|---|---|
| Zoom Rare Audio Devices | Hunting | NULL | |
| Zoom Rare Input Devices | Hunting | NULL | |
| Zoom Rare Video Devices | Hunting | NULL |
None recorded.
| Used by | Procedure example |
|---|---|
| GroupAPT37 | APT37 has used an audio capturing utility known as SOUNDWAVE that captures microphone input. |
| GroupVOID MANTICORE | VOID MANTICORE has gathered audio during a Zoom session. |
| Used by | Procedure example |
|---|---|
| MalwareAttor | Attor's has a plugin that is capable of recording audio using available input sound devices. |
| MalwareBandook | Bandook has modules that are capable of capturing audio. |
| MalwareCadelspy | Cadelspy has the ability to record audio from the compromised host. |
| MalwareCobian RAT | Cobian RAT has a feature to perform voice recording on the victim’s machine. |
| MalwareCrimson | Crimson can perform audio surveillance using microphones. |
| MalwareDarkComet | DarkComet can listen in to victims' conversations through the system’s microphone. |
| MalwareDerusbi | Derusbi is capable of performing audio captures. |
| MalwareDOGCALL | DOGCALL can capture microphone data from the victim's machine. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
