tfMITRE ATT&CK technique

Video Capture T1125

Tactic: Collection
Platforms: Linux, macOS, Windows
Version: 1.2
Created: 31 May 2017
Last modified: 12 May 2026
Contributor: Praetorian

An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups70th pct

Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareTop 12%

Tools & malware88th percentile · 88% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules54th pct

Detection rules54th percentile · 54% of ATT&CK techniques have this many detection rules written or fewer.

Video Capture MITRE reference T1125

70th pctamong all ATT&CK techniques for number of groups

4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

VOID MANTICOREG1055 ↗

Has collected video from compromised victim devices.1

created 2026-04-201 referenceaka COBALT MYSTIQUE

Ember BearG1003 ↗

Has exfiltrated images from compromised IP cameras.1

created 2022-06-091 referenceaka UNC2589

SilenceG0091 ↗

Has been observed making videos of victims to observe bank employees day to day activities.1 2

created 2019-05-242 referencesaka Whisper Spider

FIN7G0046 ↗

Created a custom video recording capability that could be used to monitor operations in the victim's environment.1 2

created 2017-05-312 referencesaka GOLD NIAGARA

All 4 groups for this technique

Offense vs defense T1125

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 2

first rule: 2020 Q2

Video Capture detection strategy DET0197

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavior-chain, platform-aware detection strategy for T1125 Video Capture

Enterprise

3 platforms

AN0568 · Windows

A non-standard process (or script-hosted process) loads camera/video-capture libraries (e.g., avicap32.dll, mf.dll, ksproxy.ax), opens the Camera Frame Server/device, writes video/image artifacts (e.g., .mp4/.avi/.yuv) to unusual locations, and optionally initiates outbound transfer shortly after.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	WinEventLog:Sysmon	EventCode=7
OS API ExecutionDC0021	WinEventLog:Security	EventCode=4663, 4670, 4656
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Process MetadataDC0034	WinEventLog:Microsoft-Windows-Windows Camera Frame Server/Operational	Process session start/stop events for camera pipeline by unexpected executables
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Correlation window (e.g., 0–20 minutes) between device access, file creation, and egress.
AllowedProcesses	Known legitimate camera consumers (e.g., Teams.exe, zoom.exe, obs64.exe) to suppress.
VideoExtensions	List of extensions to flag (.mp4, .avi, .mov, .yuv, .mkv, .h264) – tune for your estate.
RarePathRegex	Regex for unusual storage locations (e.g., %TEMP%\, C:\Windows\Tasks\, user profile hidden dirs).
MinFileSizeMB	Minimum size to reduce FP from thumbnails/snapshots.
ParentProcessAllowList	Service/agent parents permitted to broker camera access.

AN0569 · Linux

A process opens/reads /dev/video* (V4L2), performs ioctl/read loops, writes large/continuous video artifacts to disk, and/or quickly establishes outbound connections for exfiltration.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
OS API ExecutionDC0021	auditd:SYSCALL	openat/read/ioctl: openat/read/ioctl on /dev/video* by uncommon user/process
Process MetadataDC0034	linux:osquery	select: path LIKE '/dev/video%'
File AccessDC0055	auditd:SYSCALL	PATH records referencing /dev/video*
Command ExecutionDC0064	linux:syslog	sudo execution of ffmpeg/gst-launch/v4l2-ctl by non-standard user
Network Traffic ContentDC0085	NSM:Flow	http/file-xfer: Outbound transfer of large video-like MIME types soon after capture

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SyscallSet	Which syscalls to audit (openat, read, ioctl) – performance sensitive.
AllowedCallers	Legitimate processes (e.g., motion, Zoom, Chrome) that access /dev/video*.
VideoExtensions	List of file extensions to flag (.mp4/.avi/.mov/.mkv/.yuv/.h264).
MinContinuousReadCount	Minimum read/ioctl count to infer continuous capture.
TimeWindow	Correlate device open → file write → network exfil (e.g., 30m).

AN0570 · macOS

A non-whitelisted process receives TCC camera entitlement (kTCCServiceCamera), opens AppleCamera/AVFoundation device handles, writes .mov/.mp4 artifacts to unusual locations, and/or beacons/exfiltrates soon after.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
OS API ExecutionDC0021	macos:unifiedlog	Access decisions to kTCCServiceCamera for unexpected binaries
Process CreationDC0032	macos:endpointsecurity	exec: Exec of ffmpeg, avfoundation-based binaries, or custom signed apps accessing camera
File CreationDC0039	macos:unifiedlog	Process wrote large .mov/.mp4 in user temp/hidden dirs
File AccessDC0055	macos:endpointsecurity	open: Process opens AppleCamera/IOUSB device nodes or AVFoundation frameworks

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TCCAllowList	Legitimate apps (Zoom, Teams, FaceTime) that are permitted to camera.
VideoExtensions	Mov/mp4/mkv/yuv etc., tuned to environment workloads.
TimeWindow	Correlation between TCC grant → file write → network egress.
MinFileSizeMB	Reduce FP from thumbnails/snapshots.
LaunchAgentPaths	Allowed persistence paths to reduce false positives when correlating with persistence.

Tests1Executorscmd 1Need elevation0 of 1Have prerequisites0Have cleanup1Platformswindows

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup	Ref
01	Registry artefact when application use webcam	windows	cmd	—	—	Yes
can-you-track-processes-accessing-the-camera-and-microphone Attack command reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged\C:#Windows#Temp#atomic.exe /v LastUsedTimeStart /t REG_BINARY /d a273b6f07104d601 /f reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged\C:#Windows#Temp#atomic.exe /v LastUsedTimeStop /t REG_BINARY /d 96ef514b7204d601 /f Cleanup command reg DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged\C:#Windows#Temp#atomic.exe /f GUIDf63e241a-65a7-4e79-901d-9a21eadeefbb

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Registry artefact when application use webcam

windows

cmd

—

Yes

Tests from Atomic Red Team (MIT licence) · technique definition

Video Capture detections T1125

3 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

54th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs