AN0619
Analytic 0619
Windows
Unusual or unauthorized processes accessing microphone APIs (e.g., winmm.dll, avrt.dll) followed by audio file writes to user-accessible or temp directories.
WinEventLog:Sysmon
EventCode=10
WinEventLog:Sysmon
EventCode=11
WinEventLog:Security
EventCode=4688
[TimeWindow]
Time span in which the process accesses audio APIs and writes files, to reduce false positives.
[TargetProcess]
Set of approved processes known to legitimately use microphone (e.g., Zoom, Teams).
[WriteDirectory]
Allowlist of paths where legitimate apps store audio (e.g., user media folders).
AN0620
Analytic 0620
Linux
Processes accessing ALSA/PulseAudio devices or executing audio capture binaries like 'arecord', followed by file creation or suspicious child process spawning.
auditd:SYSCALL
open
linux:Sysmon
EventCode=1
auditd:SYSCALL
write
[ExecutableName]
Capture binaries like arecord, parecord, or ffmpeg.
[DevicePath]
Log attempts to access /dev/snd/*, /dev/dsp, /proc/asound/*.
[UserContext]
Whether the user has audio access rights or is running under elevated privileges.
AN0621
Analytic 0621
macOS
Processes invoking AVFoundation or CoreAudio frameworks, accessing input devices via TCC logs or Unified Logs, followed by writing AIFF/WAV/MP3 files to disk.
macos:unifiedlog
audio APIs
Apple TCC Logs
Microphone Access Events
fs:fsusage
File IO
[FrameworkCall]
CoreAudio vs. AVFoundation vs. lower-level device access APIs.
[TargetDirectory]
Suspicious file drops (e.g., ~/Library/Caches/, /tmp/, nonstandard user folders).
[AnomalousParent]
Unexpected parent-child relationship between non-media apps and AV capture.