AN0568 Analytic 0568

Windows · attack.mitre.org · ATT&CK Enterprise v19.2

<p>A non-standard process (or script-hosted process) loads camera/video-capture libraries (e.g., avicap32.dll, mf.dll, ksproxy.ax), opens the Camera Frame Server/device, writes video/image artifacts (e.g., .mp4/.avi/.yuv) to unusual locations, and optionally initiates outbound transfer shortly after.</p>

Detects: T1125 Video Capture
Part of: DET0197 Behavior-chain, platform-aware detection strategy for T1125 Video Capture

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log source	Channel	Data component
WinEventLog:Sysmon	`EventCode=1`	DC0032 Process Creation
WinEventLog:Sysmon	`EventCode=3, 22`	DC0082 Network Connection Creation
WinEventLog:Sysmon	`EventCode=7`	DC0016 Module Load
WinEventLog:Sysmon	`EventCode=11`	DC0039 File Creation
WinEventLog:Security	`EventCode=4663, 4670, 4656`	DC0021 OS API Execution
WinEventLog:Microsoft-Windows-Windows Camera Frame Server/Operational	`Process session start/stop events for camera pipeline by unexpected executables`	DC0034 Process Metadata

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

Field	Description
`TimeWindow`	Correlation window (e.g., 0–20 minutes) between device access, file creation, and egress.
`AllowedProcesses`	Known legitimate camera consumers (e.g., Teams.exe, zoom.exe, obs64.exe) to suppress.
`VideoExtensions`	List of extensions to flag (.mp4, .avi, .mov, .yuv, .mkv, .h264) – tune for your estate.
`RarePathRegex`	Regex for unusual storage locations (e.g., %TEMP%\, C:\Windows\Tasks\, user profile hidden dirs).
`MinFileSizeMB`	Minimum size to reduce FP from thumbnails/snapshots.
`ParentProcessAllowList`	Service/agent parents permitted to broker camera access.