Analytics BIOC
Low
✕
An unpopular process accessed the microphone on the host
An unpopular process accessed the microphone on the host, the process can abuse this device.
- Module:
- Platform Analytics
- Data source:
- XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK tactics: Collection (TA0009)
ATT&CK techniques: Audio Capture (T1123) Video Capture (T1125)
Attacker's goals:
Surround recording or video capture in the workplace may leak corporate data. Surround recording or video capture of the user space can expose them to potential risks as worker extortion, sextortion, etc.
Investigative actions:
Check if the application that registered in the Microsoft privacy settings (ConsentStore in registry) is legitimate. Check if the user was aware of the use of the device.
- Test period:
- N/A (single event)
- Deduplication:
- 7 Days
1 variation:
- An unpopular process accessed the webcam on the host Low