Ctrl+K

T1123 - Audio Capture

T1123 - Audio Capture#

An adversary can leverage a computer’s peripheral devices (e.g., microphones and webcams) or applications (e.g., voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information.

Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture audio. Audio files may be written to disk and exfiltrated later.

Atomic Tests#

Atomic Test #1 - using device audio capture commandletAudioDeviceCmdlets#

Supported Platforms: windows#### Attack Commands: Run with powershell

powershell.exe -Command WindowsAudioDevice-Powershell-Cmdlet

Invoke-AtomicTest T1123 -TestNumbers 1

Atomic Test #2 - Registry artefact when application use microphonecan-you-track-processes-accessing-the-camera-and-microphone#

Supported Platforms: windows#### Attack Commands: Run with command_prompt

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged\C:#Windows#Temp#atomic.exe /v LastUsedTimeStart /t REG_BINARY /d a273b6f07104d601 /f
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged\C:#Windows#Temp#atomic.exe /v LastUsedTimeStop /t REG_BINARY /d 96ef514b7204d601 /f

Invoke-AtomicTest T1123 -TestNumbers 2

Cleanup:#

reg DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged\C:#Windows#Temp#atomic.exe /f

Invoke-AtomicTest T1123 -TestNumbers 2 -Cleanup

Atomic Test #3 - using Quicktime PlayerUse AppleScript to get Quicktime Player to record an audio file from the default microphone.#

Should create a non-empty m4a file with sound from the microphone.

  • requires Automation permissions but no additional microphone permissions

  • saves file in /tmp by default. Other locations likely to require more permissions. Supported Platforms: macos#### Attack Commands: Run with sh

sh PathToAtomicsFolder/T1123/src/T1123.sh /tmp/T1123.m4a 5

Invoke-AtomicTest T1123 -TestNumbers 3

Cleanup:#

if test -w /tmp/T1123.m4a; then
  rm /tmp/T1123.m4a
fi

Invoke-AtomicTest T1123 -TestNumbers 3 -Cleanup

Detection#

Detection of this technique may be difficult due to the various APIs that may be used. Telemetry data regarding API use may not be useful depending on how a system is normally used, but may provide context to other potentially malicious activity occurring on a system.

Behavior that could indicate technique use include an unknown or unusual process accessing APIs associated with devices or software that interact with the microphone, recording devices, or recording software, and a process periodically writing files to disk that contain audio data.

Shield Active Defense#

Decoy Content#

Seed content that can be used to lead an adversary in a specific direction, entice a behavior, etc.

Decoy Content is the data used to tell a story to an adversary. This content can be legitimate or synthetic data which is used to reinforce or validate your defensive strategy. Examples of decoy content are files on a storage object, entries in the system registry, system shortcuts, etc.

Opportunity#

There is an opportunity to feed content to an adversary to influence their behaviors, test their interest in specific topics, or add legitimacy to a system or environment.

Use Case#

A defender can introduce decoy audio content designed to make the adversary believe that their audio capture efforts are working.

Procedures#

Create directories and files with names and contents using key words that may be relevant to an adversary to see if they examine or exfiltrate the data. Seed a file system with content that is of no value to the company but reinforces the legitimacy of the system if viewed by an adversary.

Contents