{"id":"T1125","name":"Video Capture","url":"https://attack.mitre.org/techniques/T1125","tactics":["collection"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0197","stix_id":"x-mitre-detection-strategy--e9ee6ab5-333b-4cea-8637-23360d904472","name":"Behavior-chain, platform-aware detection strategy for T1125 Video Capture","url":"https://attack.mitre.org/detectionstrategies/DET0197","analytics":[{"id":"AN0568","stix_id":"x-mitre-analytic--171803bb-8aa7-42df-861a-18d6d694f909","name":"Analytic 0568","description":"A non-standard process (or script-hosted process) loads camera/video-capture libraries (e.g., avicap32.dll, mf.dll, ksproxy.ax), opens the Camera Frame Server/device, writes video/image artifacts (e.g., .mp4/.avi/.yuv) to unusual locations, and optionally initiates outbound transfer shortly after.","url":"https://attack.mitre.org/detectionstrategies/DET0197#AN0568","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","data_component":"DC0021","data_component_name":"OS API Execution","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Microsoft-Windows-Windows Camera Frame Server/Operational","channel":"Process session start/stop events for camera pipeline by unexpected executables","data_component":"DC0034","data_component_name":"Process Metadata","log_source_slug":"wineventlog-microsoft-windows-windows-camera-frame-server-operational"}],"mutable_elements":[{"field":"TimeWindow","description":"Correlation window (e.g., 0–20 minutes) between device access, file creation, and egress."},{"field":"AllowedProcesses","description":"Known legitimate camera consumers (e.g., Teams.exe, zoom.exe, obs64.exe) to suppress."},{"field":"VideoExtensions","description":"List of extensions to flag (.mp4, .avi, .mov, .yuv, .mkv, .h264) – tune for your estate."},{"field":"RarePathRegex","description":"Regex for unusual storage locations (e.g., %TEMP%\\*, C:\\Windows\\Tasks\\*, user profile hidden dirs)."},{"field":"MinFileSizeMB","description":"Minimum size to reduce FP from thumbnails/snapshots."},{"field":"ParentProcessAllowList","description":"Service/agent parents permitted to broker camera access."}],"live":true,"detection_strategies":["DET0197"],"techniques":["T1125"]},{"id":"AN0569","stix_id":"x-mitre-analytic--f3c5c71a-da1b-4d09-bda7-ec07b0b7c05d","name":"Analytic 0569","description":"A process opens/reads /dev/video* (V4L2), performs ioctl/read loops, writes large/continuous video artifacts to disk, and/or quickly establishes outbound connections for exfiltration.","url":"https://attack.mitre.org/detectionstrategies/DET0197#AN0569","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"openat/read/ioctl: openat/read/ioctl on /dev/video* by uncommon user/process","data_component":"DC0021","data_component_name":"OS API Execution","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"PATH records referencing /dev/video*","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"auditd-syscall"},{"name":"linux:osquery","channel":"select: path LIKE '/dev/video%'","data_component":"DC0034","data_component_name":"Process Metadata","log_source_slug":"linux-osquery"},{"name":"linux:syslog","channel":"sudo execution of ffmpeg/gst-launch/v4l2-ctl by non-standard user","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"linux-syslog"},{"name":"NSM:Flow","channel":"http/file-xfer: Outbound transfer of large video-like MIME types soon after capture","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"SyscallSet","description":"Which syscalls to audit (openat, read, ioctl) – performance sensitive."},{"field":"AllowedCallers","description":"Legitimate processes (e.g., motion, Zoom, Chrome) that access /dev/video*."},{"field":"VideoExtensions","description":"List of file extensions to flag (.mp4/.avi/.mov/.mkv/.yuv/.h264)."},{"field":"MinContinuousReadCount","description":"Minimum read/ioctl count to infer continuous capture."},{"field":"TimeWindow","description":"Correlate device open → file write → network exfil (e.g., 30m)."}],"live":true,"detection_strategies":["DET0197"],"techniques":["T1125"]},{"id":"AN0570","stix_id":"x-mitre-analytic--db3263c7-0abc-47be-a9f3-434d255b1e0e","name":"Analytic 0570","description":"A non-whitelisted process receives TCC camera entitlement (kTCCServiceCamera), opens AppleCamera/AVFoundation device handles, writes .mov/.mp4 artifacts to unusual locations, and/or beacons/exfiltrates soon after.","url":"https://attack.mitre.org/detectionstrategies/DET0197#AN0570","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Access decisions to kTCCServiceCamera for unexpected binaries","data_component":"DC0021","data_component_name":"OS API Execution","log_source_slug":"macos-unifiedlog"},{"name":"macos:endpointsecurity","channel":"open: Process opens AppleCamera/IOUSB device nodes or AVFoundation frameworks","data_component":"DC0055","data_component_name":"File Access","log_source_slug":"macos-endpointsecurity"},{"name":"macos:endpointsecurity","channel":"exec: Exec of ffmpeg, avfoundation-based binaries, or custom signed apps accessing camera","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-endpointsecurity"},{"name":"macos:unifiedlog","channel":"Process wrote large .mov/.mp4 in user temp/hidden dirs","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"TCCAllowList","description":"Legitimate apps (Zoom, Teams, FaceTime) that are permitted to camera."},{"field":"VideoExtensions","description":"Mov/mp4/mkv/yuv etc., tuned to environment workloads."},{"field":"TimeWindow","description":"Correlation between TCC grant → file write → network egress."},{"field":"MinFileSizeMB","description":"Reduce FP from thumbnails/snapshots."},{"field":"LaunchAgentPaths","description":"Allowed persistence paths to reduce false positives when correlating with persistence."}],"live":true,"detection_strategies":["DET0197"],"techniques":["T1125"]}],"live":true,"version":"1.0","techniques":["T1125"]}],"sigma_rules":[{"id":"62120148-6b7a-42be-8b91-271c04e281a3","title":"Suspicious Camera and Microphone Access","author":"Den Iuzvyk","status":"test","level":"high","date":"2020-06-07","modified":"2022-10-09","description":"Detects Processes accessing the camera and microphone from suspicious folder","references":["https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072"],"logsource":{"product":"windows","category":"registry_event"},"tags":["attack.collection","attack.t1125","attack.t1123"],"path":"rules/windows/registry/registry_event/registry_event_susp_mic_cam_access.yml","techniques":["T1125","T1123"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}