T1125 — Video Capture

Tactic: Collection · Platforms: Linux, macOS, Windows

An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified…

Sigma detection rules (3)

T1125 Video Capture

title: T1125 Video Capture
id: 6980d627-aae3-4955-8db0-6260a60fdae8
description: 'Detects ffmpeg webcam/screen-capture invocations or PowerShell/.NET Windows.Media.Capture usage. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, AllowedProcesses, VideoExtensions, RarePathRegex, MinFileSizeMB, ParentProcessAllowList.'
references:
  - https://attack.mitre.org/techniques/T1125
author: Shahrukh Khan
date: 2026-05-30
license: MIT
tags:
  - attack.collection
  - attack.t1125

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_ffmpeg_capture:
    EventID: '1'
    Image|endswith: '\ffmpeg.exe'
    CommandLine|contains:
      - '-f dshow'
      - '-f vfwcap'
      - '-f gdigrab'
  selection_capture_api:
    EventID: '1'
    CommandLine|contains:
      - 'Windows.Media.Capture'
      - 'MediaCapture'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: (selection_ffmpeg_capture or selection_capture_api) and not filter_system_account

falsepositives:
  - Legitimate screen recording/streaming/accessibility tooling.

level: medium

T1125 Video Capture

title: T1125 Video Capture
id: dc5d5cc8-1373-4c4e-a71d-ff89ab152b8d
description: 'Behavior-chain, platform-aware detection strategy for T1125 Video Capture. Fixed the fragile argv-position assumption: real ffmpeg invocations commonly place the -i /dev/videoN device path at a3/a4 or later (for example -f v4l2 -i /dev/video0), so matching only a1 missed most real invocations. The device-path check now matches across a1 through a6. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: SyscallSet, AllowedCallers, VideoExtensions, MinContinuousReadCount, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1125
author: Shahrukh Khan
date: 2026-02-23
license: MIT
tags:
  - attack.collection
  - attack.t1125

logsource:
  product: linux
  service: auditd

detection:
  selection_ffmpeg:
    type: EXECVE
    a0|endswith: '/ffmpeg'
  selection_video_device:
    - a1|contains: '/dev/video'
    - a2|contains: '/dev/video'
    - a3|contains: '/dev/video'
    - a4|contains: '/dev/video'
    - a5|contains: '/dev/video'
    - a6|contains: '/dev/video'

  condition: selection_ffmpeg and selection_video_device

falsepositives:
  - ffmpeg accessing /dev/video* is legitimately used for video conferencing, streaming, and camera testing; scope to servers without expected camera hardware/use cases.

level: medium

T1125 Video Capture

title: T1125 Video Capture
id: e7d60374-eea9-418a-9ebb-9c4f7cf040d4
description: 'Behavior-chain, platform-aware detection strategy for T1125 Video Capture. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TCCAllowList, VideoExtensions, TimeWindow, MinFileSizeMB, LaunchAgentPaths.'
references:
  - https://attack.mitre.org/techniques/T1125
author: Shahrukh Khan
date: 2026-03-12
license: MIT
tags:
  - attack.collection
  - attack.t1125

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/python3'
      - '/osascript'
    CommandLine|contains:
      - 'AVCaptureDevice'
      - 'QuickTime Player'

  condition: selection

falsepositives:
  - Legitimate video conferencing or QuickTime-based screen and video recording triggers similar command lines.

level: high

Explore