Techniques › T1125
T1125 Video Capture
collection — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
1
Sigma rules tagged attack.t1125
0
KEV CVEs mapped here
<p>An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files.</p><p>Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture video or images. Video or image files may be written to disk and exfiltrated later. This technique differs from Screen Capture due to use of specific devices or applications for video recording rather than capturing the victim's screen.</p><p>In macOS, there are a few different malware samples that record the user's webcam such as FruitFly and Proton.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0197 Behavior-chain, platform-aware detection strategy for T1125 Video Capture v1.0
AN0568 WindowsA non-standard process (or script-hosted process) loads camera/video-capture libraries (e.g., avicap32.dll, mf.dll, ksproxy.ax), opens the Camera Frame Server/device, writes video/image artifacts (e.g., .mp4/.avi/.yuv) to unusual locations, and optionally initiates outbound transfer shortly after.WinEventLog:Microsoft-Windows-Windows Camera Frame Server/Operational
Process session start/stop events for camera pipeline by unexpected executables→ DC0034 Process MetadataTunable:TimeWindowAllowedProcessesVideoExtensionsRarePathRegexMinFileSizeMBParentProcessAllowListAN0569 LinuxA process opens/reads /dev/video* (V4L2), performs ioctl/read loops, writes large/continuous video artifacts to disk, and/or quickly establishes outbound connections for exfiltration.auditd:SYSCALLopenat/read/ioctl: openat/read/ioctl on /dev/video* by uncommon user/process→ DC0021 OS API Executionlinux:syslogsudo execution of ffmpeg/gst-launch/v4l2-ctl by non-standard user→ DC0064 Command ExecutionNSM:Flowhttp/file-xfer: Outbound transfer of large video-like MIME types soon after capture→ DC0085 Network Traffic ContentTunable:SyscallSetAllowedCallersVideoExtensionsMinContinuousReadCountTimeWindowAN0570 macOSA non-whitelisted process receives TCC camera entitlement (kTCCServiceCamera), opens AppleCamera/AVFoundation device handles, writes .mov/.mp4 artifacts to unusual locations, and/or beacons/exfiltrates soon after.macos:unifiedlogAccess decisions to kTCCServiceCamera for unexpected binaries→ DC0021 OS API Executionmacos:endpointsecurityopen: Process opens AppleCamera/IOUSB device nodes or AVFoundation frameworks→ DC0055 File Accessmacos:endpointsecurityexec: Exec of ffmpeg, avfoundation-based binaries, or custom signed apps accessing camera→ DC0032 Process CreationTunable:TCCAllowListVideoExtensionsTimeWindowMinFileSizeMBLaunchAgentPaths
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1125
Author: Den Iuzvyk
· 2020-06-07 (modified 2022-10-09) · logsource: product=windows category=registry_event · 62120148-6b7a-42be-8b91-271c04e281a3
Detects Processes accessing the camera and microphone from suspicious folder