t1123-audio-capture

name	T1123_audio-capture
description	An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listen...
category	information-gathering
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1123","collection","linux","macos","windows"]
technique_id	T1123
tactic	collection
all_tactics	["collection"]
platforms	["Linux","macOS","Windows"]
mitre_url	https://attack.mitre.org/techniques/T1123
tech_stack	["linux","macos","windows"]
cwe_ids	["CWE-200"]
chains_with	[]
prerequisites	[]
severity_boost	{}

T1123 Audio Capture

High-Level Description

An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information.

Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture audio. Audio files may be written to disk and exfiltrated later.

Kill Chain Phase

• Collection (TA0009)

Platforms: Linux, macOS, Windows

What to Check

• Identify if Audio Capture technique is applicable to target environment
• Check Linux systems for indicators of Audio Capture
• Check macOS systems for indicators of Audio Capture
• Check Windows systems for indicators of Audio Capture
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: using device audio capture commandlet

Uses AudioDeviceCmdlets to set the default recording device and simulate audio capture. Module repo: AudioDeviceCmdlets

Supported Platforms: windows

$mic = Get-AudioDevice -Recording
Set-AudioDevice -ID $mic.ID
Start-Sleep -Seconds 5

Dependencies:

• AudioDeviceCmdlets module must be installed

Atomic Test 2: Registry artefact when application use microphone

can-you-track-processes-accessing-the-camera-and-microphone

Supported Platforms: windows

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged\C:#Windows#Temp#atomic.exe /v LastUsedTimeStart /t REG_BINARY /d a273b6f07104d601 /f
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged\C:#Windows#Temp#atomic.exe /v LastUsedTimeStop /t REG_BINARY /d 96ef514b7204d601 /f