Audio Capture via PowerShell

calendar Apr 11, 2023 · attack.collection attack.t1123  ·
Share on: linkedin copy

Detects audio capture via PowerShell Cmdlet.

Sigma rule (View on GitHub)

 1title: Audio Capture via PowerShell
 2id: 932fb0d8-692b-4b0f-a26e-5643a50fe7d6
 3status: test
 4description: Detects audio capture via PowerShell Cmdlet.
 5references:
 6    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1123/T1123.md
 7    - https://eqllib.readthedocs.io/en/latest/analytics/ab7a6ef4-0983-4275-a4f1-5c6bd3c31c23.html
 8    - https://github.com/frgnca/AudioDeviceCmdlets
 9author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Nasreddine Bencherchali (Nextron Systems)
10date: 2019/10/24
11modified: 2023/04/06
12tags:
13    - attack.collection
14    - attack.t1123
15logsource:
16    category: process_creation
17    product: windows
18detection:
19    selection:
20        CommandLine|contains:
21            - 'WindowsAudioDevice-Powershell-Cmdlet'
22            - 'Toggle-AudioDevice'
23            - 'Get-AudioDevice '
24            - 'Set-AudioDevice '
25            - 'Write-AudioDevice '
26    condition: selection
27falsepositives:
28    - Legitimate audio capture by legitimate user.
29level: medium

References

Related rules

to-top