Audio Capture via PowerShell
Detects audio capture via PowerShell Cmdlet.
Sigma rule (View on GitHub)
1title: Audio Capture via PowerShell
2id: 932fb0d8-692b-4b0f-a26e-5643a50fe7d6
3status: test
4description: Detects audio capture via PowerShell Cmdlet.
5references:
6 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1123/T1123.md
7 - https://eqllib.readthedocs.io/en/latest/analytics/ab7a6ef4-0983-4275-a4f1-5c6bd3c31c23.html
8 - https://github.com/frgnca/AudioDeviceCmdlets
9author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Nasreddine Bencherchali (Nextron Systems)
10date: 2019-10-24
11modified: 2023-04-06
12tags:
13 - attack.collection
14 - attack.t1123
15logsource:
16 category: process_creation
17 product: windows
18detection:
19 selection:
20 CommandLine|contains:
21 - 'WindowsAudioDevice-Powershell-Cmdlet'
22 - 'Toggle-AudioDevice'
23 - 'Get-AudioDevice '
24 - 'Set-AudioDevice '
25 - 'Write-AudioDevice '
26 condition: selection
27falsepositives:
28 - Legitimate audio capture by legitimate user.
29level: medium
References
-
Small and highly portable detection tests based on MITRE's ATT&CK. - redcanaryco/atomic-red-team
Read More -
-
AudioDeviceCmdlets is a suite of PowerShell Cmdlets to control audio devices on Windows - frgnca/AudioDeviceCmdlets
Read More
Related rules
- Audio Capture
- Audio Capture via SoundRecorder
- Linux Capabilities Discovery
- OpenCanary - SIP Request
- Processes Accessing the Microphone and Webcam