T1123 Audio Capture

T1123 Audio Capture

High-Level Description

An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information.

Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture audio. Audio files may be written to disk and exfiltrated later.

Kill Chain Phase

• Collection (TA0009)

Platforms: Linux, macOS, Windows

What to Check

• Identify if Audio Capture technique is applicable to target environment
• Check Linux systems for indicators of Audio Capture
• Check macOS systems for indicators of Audio Capture
• Check Windows systems for indicators of Audio Capture
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: using device audio capture commandlet

Uses AudioDeviceCmdlets to set the default recording device and simulate audio capture. Module repo: AudioDeviceCmdlets

Supported Platforms: windows

$mic = Get-AudioDevice -Recording
Set-AudioDevice -ID $mic.ID
Start-Sleep -Seconds 5