Suspicious Camera and Microphone Access

Title: Suspicious Camera and Microphone Access
Status: test
Description:Detects Processes accessing the camera and microphone from suspicious folder
References:
  -https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072
Author: Den Iuzvyk
Date: 2020-06-07
modified:2022-10-09
Tags:

• -'attack.collection'
• -'attack.t1125'
• -'attack.t1123'

Logsource:

• category: registry_event
• product: windows

Detection:
  selection_1:
    TargetObject|contains|all:
      -'\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\'
      -'\NonPackaged'

  selection_2:
    TargetObject|contains:
      -'microphone'
      -'webcam'

  selection_3:
    TargetObject|contains:
      -':#Windows#Temp#'
      -':#$Recycle.bin#'
      -':#Temp#'
      -':#Users#Public#'
      -':#Users#Default#'
      -':#Users#Desktop#'

  condition:all of selection_*
Falsepositives:
  -Unlikely, there could be conferencing software running from a Temp folder accessing the devices
Level: high