An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information.[1]
Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture audio. Audio files may be written to disk and exfiltrated later.
56th pctamong all ATT&CK techniques for number of groups
2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has used an audio capturing utility known as SOUNDWAVE that captures microphone input.1
created 2018-04-181 referenceaka InkySquid
All 2 groups for this technique
30 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection Strategy for T1123 Audio Capture Across Windows, Linux, macOS
Enterprise
3 platforms
AN0619 · Windows
Unusual or unauthorized processes accessing microphone APIs (e.g., winmm.dll, avrt.dll) followed by audio file writes to user-accessible or temp directories.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
TimeWindow
Time span in which the process accesses audio APIs and writes files, to reduce false positives.
TargetProcess
Set of approved processes known to legitimately use microphone (e.g., Zoom, Teams).
WriteDirectory
Allowlist of paths where legitimate apps store audio (e.g., user media folders).
AN0620 · Linux
Processes accessing ALSA/PulseAudio devices or executing audio capture binaries like 'arecord', followed by file creation or suspicious child process spawning.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
ExecutableName
Capture binaries like arecord, parecord, or ffmpeg.
DevicePath
Log attempts to access /dev/snd/*, /dev/dsp, /proc/asound/*.
UserContext
Whether the user has audio access rights or is running under elevated privileges.
AN0621 · macOS
Processes invoking AVFoundation or CoreAudio frameworks, accessing input devices via TCC logs or Unified Logs, followed by writing AIFF/WAV/MP3 files to disk.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
Use AppleScript to get Quicktime Player to record an audio file from the default microphone.
Should create a non-empty m4a file with sound from the microphone.
- requires Automation permissions but no additional microphone permissions
- saves file in /tmp by default. Other locations likely to require more permissions.