Processes Accessing the Microphone and Webcam

Title: Processes Accessing the Microphone and Webcam
Status: test
Description:Potential adversaries accessing the microphone and webcam in an endpoint.
References:
  -https://twitter.com/duzvik/status/1269671601852813320
  -https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-06-07
modified:2021-11-27
Tags:

• -'attack.collection'
• -'attack.t1123'

Logsource:

• product: windows
• service: security

Detection:
  selection:
    EventID:
      -'4657'
      -'4656'
      -'4663'

    ObjectName|contains:
      -'\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone\NonPackaged'
      -'\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam\NonPackaged'

  condition:selection
Falsepositives:
  -Unknown
Level: medium