Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1125_video-capture
An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering ...
Passed 20 of 23 test cases with the skill, and 13 of 23 without it.
and 4 more in the full report
7 fixed13 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
Security researchers analyzing macOS threats need to cite historical malware families that specifically record user webcams. While malware like DarkComet targeted Windows webcams, which two macOS malware samples are explicitly highlighted in T1125 documentation?
| Checked | Without skill | With skill |
|---|---|---|
| Names FruitFly as a macOS malware example. | Passed | Passed |
| Names Proton as a macOS malware example. | Missed | Passed |
The instructions your model reads when the skill loads.
An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files.
Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture video or images. Video or image files may be written to disk and exfiltrated later. This technique differs from Screen Capture due to use of specific devices or applications for video recording rather than capturing the victim's screen.
In macOS, there are a few different malware samples that record the user's webcam such as FruitFly and Proton.
Platforms: Windows, macOS, Linux
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
can-you-track-processes-accessing-the-camera-and-microphone
Supported Platforms: windows
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged\C:#Windows#Temp#atomic.exe /v LastUsedTimeStart /t REG_BINARY /d a273b6f07104d601 /f
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged\C:#Windows#Temp#atomic.exe /v LastUsedTimeStop /t REG_BINARY /d 96ef514b7204d601 /f
test cases passed, vs 13 / 23 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.