Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0197 — Behavior-chain, platform-aware detection strategy for T1125 Video Capture
DET0197

Behavior-chain, platform-aware detection strategy for T1125 Video Capture

3 analytic(s) · 1 technique(s) detected

Analytics

3
AN0568 Analytic 0568
Windows

A non-standard process (or script-hosted process) loads camera/video-capture libraries (e.g., avicap32.dll, mf.dll, ksproxy.ax), opens the Camera Frame Server/device, writes video/image artifacts (e.g., .mp4/.avi/.yuv) to unusual locations, and optionally initiates outbound transfer shortly after.

WinEventLog:Sysmon EventCode=1 WinEventLog:Sysmon EventCode=3, 22 WinEventLog:Sysmon EventCode=7 WinEventLog:Sysmon EventCode=11 WinEventLog:Security EventCode=4663, 4670, 4656 WinEventLog:Microsoft-Windows-Windows Camera Frame Server/Operational Process session start/stop events for camera pipeline by unexpected executables
[TimeWindow] Correlation window (e.g., 0–20 minutes) between device access, file creation, and egress.
[AllowedProcesses] Known legitimate camera consumers (e.g., Teams.exe, zoom.exe, obs64.exe) to suppress.
[VideoExtensions] List of extensions to flag (.mp4, .avi, .mov, .yuv, .mkv, .h264) – tune for your estate.
[RarePathRegex] Regex for unusual storage locations (e.g., %TEMP%\*, C:\Windows\Tasks\*, user profile hidden dirs).
[MinFileSizeMB] Minimum size to reduce FP from thumbnails/snapshots.
[ParentProcessAllowList] Service/agent parents permitted to broker camera access.
AN0569 Analytic 0569
Linux

A process opens/reads /dev/video* (V4L2), performs ioctl/read loops, writes large/continuous video artifacts to disk, and/or quickly establishes outbound connections for exfiltration.

auditd:SYSCALL openat/read/ioctl: openat/read/ioctl on /dev/video* by uncommon user/process auditd:SYSCALL PATH records referencing /dev/video* linux:osquery select: path LIKE '/dev/video%' linux:syslog sudo execution of ffmpeg/gst-launch/v4l2-ctl by non-standard user NSM:Flow http/file-xfer: Outbound transfer of large video-like MIME types soon after capture
[SyscallSet] Which syscalls to audit (openat, read, ioctl) – performance sensitive.
[AllowedCallers] Legitimate processes (e.g., motion, Zoom, Chrome) that access /dev/video*.
[VideoExtensions] List of file extensions to flag (.mp4/.avi/.mov/.mkv/.yuv/.h264).
[MinContinuousReadCount] Minimum read/ioctl count to infer continuous capture.
[TimeWindow] Correlate device open → file write → network exfil (e.g., 30m).
AN0570 Analytic 0570
macOS

A non-whitelisted process receives TCC camera entitlement (kTCCServiceCamera), opens AppleCamera/AVFoundation device handles, writes .mov/.mp4 artifacts to unusual locations, and/or beacons/exfiltrates soon after.

macos:unifiedlog Access decisions to kTCCServiceCamera for unexpected binaries macos:endpointsecurity open: Process opens AppleCamera/IOUSB device nodes or AVFoundation frameworks macos:endpointsecurity exec: Exec of ffmpeg, avfoundation-based binaries, or custom signed apps accessing camera macos:unifiedlog Process wrote large .mov/.mp4 in user temp/hidden dirs
[TCCAllowList] Legitimate apps (Zoom, Teams, FaceTime) that are permitted to camera.
[VideoExtensions] Mov/mp4/mkv/yuv etc., tuned to environment workloads.
[TimeWindow] Correlation between TCC grant → file write → network egress.
[MinFileSizeMB] Reduce FP from thumbnails/snapshots.
[LaunchAgentPaths] Allowed persistence paths to reduce false positives when correlating with persistence.

Detected Techniques

1

Collection (1)

Details

MITRE ID
DET0197
STIX ID
x-mitre-detection-strategy--e9ee6ab5-333b-4cea-8637-23360d904472
Analytics
3
Techniques Detected
1
By Tactic
Collection
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.