T1123 — Audio Capture

Tactic: Collection · Platforms: Linux, macOS, Windows

An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information. Malware or scripts may be used to interact…

Sigma detection rules (3)

T1123 Audio Capture

title: T1123 Audio Capture
id: c10bf02c-a6e2-4e1e-93f4-8e5b9110a8d0
description: 'Audio capture APIs are not directly observable via Windows telemetry; proxies via audio recording files (.wav/.m4a/.mp3) created by non-media processes. (Data Component: File Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, TargetProcess, WriteDirectory.'
references:
  - https://attack.mitre.org/techniques/T1123
author: Shahrukh Khan
date: 2026-04-19
license: MIT
tags:
  - attack.collection
  - attack.t1123

logsource:
  category: file_event
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '11'
    TargetFilename|endswith:
      - '.wav'
      - '.m4a'
      - '.mp3'
  filter_media_apps:
    Image|endswith:
      - '\SoundRecorder.exe'
      - '\VoiceRecorder.exe'
      - '\WindowsCamera.exe'
      - '\Teams.exe'
      - '\lync.exe'
      - '\Skype.exe'
      - '\Zoom.exe'
      - '\vlc.exe'
      - '\wmplayer.exe'
      - '\Spotify.exe'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection and not 1 of filter_*

falsepositives:
  - Legitimate voice/meeting/media applications not on the allowlist.

level: medium

T1123 Audio Capture

title: T1123 Audio Capture
id: 8dac1475-9b33-4e9d-892a-73ae77197a50
description: 'Behavioral Detection Strategy for T1123 Audio Capture Across Windows, Linux, macOS. Requires BOTH the arecord execution AND a corresponding /dev/snd access in the same telemetry window, since either indicator alone (in particular bare /dev/snd access) is produced by routine sound device use by pulseaudio, browsers, and VOIP applications. (Retargeted to the file_event auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ExecutableName, DevicePath, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1123
author: Shahrukh Khan
date: 2026-03-31
license: MIT
tags:
  - attack.collection
  - attack.t1123

logsource:
  category: file_event
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith: '/arecord'
  selection_dev:
    type: PATH
    name|contains: '/dev/snd'
    nametype: NORMAL

  condition: all of selection*

falsepositives:
  - arecord invocations that legitimately open /dev/snd, such as scheduled voicemail/IVR recording jobs or approved audio-logging tooling; scope to headless servers where audio devices are unexpected.

level: medium

T1123 Audio Capture

title: T1123 Audio Capture
id: f322208e-a69a-4706-8427-8fdb7c1f4105
description: 'Behavioral Detection Strategy for T1123 Audio Capture Across Windows, Linux, macOS. (Retargeted to the process_access macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: FrameworkCall, TargetDirectory, AnomalousParent.'
references:
  - https://attack.mitre.org/techniques/T1123
author: Shahrukh Khan
date: 2026-01-13
license: MIT
tags:
  - attack.collection
  - attack.t1123

logsource:
  category: process_access
  product: macos

detection:
  selection:
    TargetImage|endswith: '/coreaudiod'
    SourceImage|endswith:
      - '/python3'
      - '/osascript'

  condition: selection

falsepositives:
  - Legitimate audio applications and conferencing software also interact with coreaudiod; CoreAudio framework calls are not generally exposed by the unified log without Endpoint Security API process-access events.

level: high

Explore