Analytics Alerts

Browse the Cortex analytics alert reference.

Severity ▾
Detection module ▾
Data source ▾

1 alert match the current filters. tactic: TA0009 ✕ technique: T1125 ✕

Show ATT&CK heatmap
  • An unpopular process accessed the microphone on the host Low 1 variation

    An unpopular process accessed the microphone on the host, the process can abuse this device.

    Activation:
    14 Days
    Training:
    30 Days
    Test:
    N/A (single event)
    Deduplication:
    7 Days
    ATT&CK tactics: Collection (TA0009)
    ATT&CK techniques: Audio Capture (T1123) Video Capture (T1125)
    Required data: XDR Agent with eXtended Threat Hunting (XTH)
    Attacker's goals: Surround recording or video capture in the workplace may leak corporate data. Surround recording or video capture of the user space can expose them to potential risks as worker extortion, sextortion, etc.
    Investigative actions: Check if the application that registered in the Microsoft privacy settings (ConsentStore in registry) is legitimate. Check if the user was aware of the use of the device.

    Variations

    An unpopular process accessed the webcam on the host

    Low overridden

    An unpopular process accessed the webcam on the host, the process can abuse this device. overridden