tfMITRE ATT&CK technique

Audio Capture T1123

Tactic: Collection
Platforms: Linux, macOS, Windows
Version: 1.0
Created: 31 May 2017
Last modified: 12 May 2026

An adversary can leverage a computer's peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 12%

Tools & malware88th percentile · 88% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules73rd pct

Detection rules73rd percentile · 73% of ATT&CK techniques have this many detection rules written or fewer.

Audio Capture MITRE reference T1123

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

VOID MANTICOREG1055 ↗

Has gathered audio during a Zoom session.1

created 2026-04-201 referenceaka COBALT MYSTIQUE

APT37G0067 ↗

Has used an audio capturing utility known as SOUNDWAVE that captures microphone input.1

created 2018-04-181 referenceaka InkySquid

All 2 groups for this technique

30 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

LightSpyS1185 ↗

Uses Apple's built-in AVFoundation Framework library to capture and manage audio recordings then transform them to JSON blobs for exfiltration.1

created 2025-01-03MALWAREcarried by 1 group

MgBotS1146 ↗

Can capture input and output audio streams from infected devices.1 2

created 2024-07-25MALWAREcarried by 1 group

NightClubS1090 ↗

Can load a module to leverage the LAME encoder and mciSendStringW to control and capture audio.1

created 2023-09-27MALWAREcarried by 1 group

MacMaS1016 ↗

Has the ability to record audio.1

created 2022-05-06MALWAREcarried by 1 group

TajMahalS0467 ↗

Has the ability to capture VoiceIP application audio on an infected host.1

created 2020-06-08MALWARE

CadelspyS0454 ↗

Has the ability to record audio from the compromised host.1

created 2020-05-22MALWAREcarried by 1 group

All 30 software entries for this technique · 6 newest in this preview

Offense vs defense T1123

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 3

first rule: 2019 Q4

Audio Capture detection strategy DET0221

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavioral Detection Strategy for T1123 Audio Capture Across Windows, Linux, macOS

Enterprise

3 platforms

AN0619 · Windows

Unusual or unauthorized processes accessing microphone APIs (e.g., winmm.dll, avrt.dll) followed by audio file writes to user-accessible or temp directories.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Security	EventCode=4688
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10
File CreationDC0039	WinEventLog:Sysmon	EventCode=11

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Time span in which the process accesses audio APIs and writes files, to reduce false positives.
TargetProcess	Set of approved processes known to legitimately use microphone (e.g., Zoom, Teams).
WriteDirectory	Allowlist of paths where legitimate apps store audio (e.g., user media folders).

AN0620 · Linux

Processes accessing ALSA/PulseAudio devices or executing audio capture binaries like 'arecord', followed by file creation or suspicious child process spawning.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	linux:Sysmon	EventCode=1
File CreationDC0039	auditd:SYSCALL	write
File AccessDC0055	auditd:SYSCALL	open

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ExecutableName	Capture binaries like arecord, parecord, or ffmpeg.
DevicePath	Log attempts to access /dev/snd/, /dev/dsp, /proc/asound/.
UserContext	Whether the user has audio access rights or is running under elevated privileges.

AN0621 · macOS

Processes invoking AVFoundation or CoreAudio frameworks, accessing input devices via TCC logs or Unified Logs, followed by writing AIFF/WAV/MP3 files to disk.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
OS API ExecutionDC0021	macos:unifiedlog	audio APIs
Process AccessDC0035	Apple TCC Logs	Microphone Access Events
File CreationDC0039	fs:fsusage	File IO

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
FrameworkCall	CoreAudio vs. AVFoundation vs. lower-level device access APIs.
TargetDirectory	Suspicious file drops (e.g., ~/Library/Caches/, /tmp/, nonstandard user folders).
AnomalousParent	Unexpected parent-child relationship between non-media apps and AV capture.

Tests3ExecutorsPowerShell 1 · cmd 1 · sh 1Need elevation0 of 3Have prerequisites1Have cleanup2Platformswindows, macos

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

using device audio capture commandlet

windows

PowerShell

—

Registry artefact when application use microphone

windows

cmd

—

Yes

using Quicktime Player

macos

—

Yes

Use AppleScript to get Quicktime Player to record an audio file from the default microphone. Should create a non-empty m4a file with sound from the microphone. - requires Automation permissions but no additional microphone permissions - saves file in /tmp by default. Other locations likely to require more permissions.

Input arguments

Name	Type	Default	Description
duration	integer	5	Length of recording to make in seconds
filename	path	PathToAtomicsFolder/T1123/src/T1123.sh	Location of the script
audiofile	path	/tmp/T1123.m4a	Location of the recorded audio file

Attack command

sh #{filename} #{audiofile} #{duration}

Cleanup command

if test -w #{audiofile}; then
  rm #{audiofile}
fi

GUID1cf9a241-3136-4358-859f-94a7b174207b

Tests from Atomic Red Team (MIT licence) · technique definition

Audio Capture detections T1123

9 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

73rd pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs